REPORTED DEVELOPMENT
CVE publication window: 21-22 October; original disclosure predates it.
CVE-2026-114123, CVSS 7.5 High, concerns dynamics365ninja's open-source MCP server, whose Azure default configuration used an empty API key. Without additional protection, proprietary X++ code, metadata and security configuration could be exposed. Version 1.11.0 fixes it.
This affects that third-party component, not Microsoft Dynamics 365 generally. Original disclosure preceded the 21-22 October CVE publication.
WHY IT MATTERS TO THE MARKET
Integration-level authentication must be assessed independently of the security of the enterprise platform it connects to.