MicrosoftCVE-2026-47646

Microsoft Dynamics 365 Customer Voice: cross-site scripting

Critical9.3CVE-2026-47646 · Published Jul 9, 2026

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Dynamics 365 Customer Voice Product	all versions	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-79

More Microsoft advisories

All Microsoft

Date	Advisory	Severity	Fixed in
Jul 14	Microsoft Windows Media: information disclosure Medium5.5Jul 14 CVE-2026-3434910.0.17763.9020+7 more	Medium5.5	10.0.17763.9020+7 more
Jul 14	Microsoft Windows Event Logging Service: protection mechanism failure Medium6.5Jul 14 CVE-2026-3434810.0.17763.9020+8 more	Medium6.5	10.0.17763.9020+8 more
Jul 14	Microsoft Windows Ancillary Function Driver for WinSock: cleartext secrets Medium5.5Jul 14 CVE-2026-3434610.0.14393.9339+9 more	Medium5.5	10.0.14393.9339+9 more
Jul 12	Microsoft Edge (Chromium-based): privilege escalation High8.3Jul 12 CVE-2026-58596150.0.4078.48	High8.3	150.0.4078.48
Jul 11	Microsoft Edge (Chromium-based): unsafe deserialization High8.3Jul 11 CVE-2026-58281150.0.4078.48	High8.3	150.0.4078.48
Jul 8	Microsoft Edge (Chromium-based): improper access control High8.2Jul 8 CVE-2026-58525150.0.4078.50	High8.2	150.0.4078.50

Affected versions

More Microsoft advisories

Critical advisories by email