Introduction
An attacker who escalates privileges in a customer service system can expose sensitive communications, reach business workflows they should not have access to, and potentially cause regulatory violations. CVE-2025-64655 is an improper authorization flaw in Microsoft Dynamics OmniChannel SDK Storage Containers. It is a high-severity issue that lets attackers bypass access controls and escalate privileges over the network.
Microsoft Dynamics 365 is a widely adopted suite of enterprise CRM and ERP applications. Its OmniChannel capabilities let organizations manage customer interactions across chat, voice, and digital channels. The OmniChannel SDK Storage Containers are core components that store and retrieve customer service data in these environments.
Technical information
CVE-2025-64655 comes from improper authorization checks in the Dynamics OmniChannel SDK Storage Containers. It is classified under CWE-285, which covers products that fail to enforce authorization correctly before granting access to resources or operations.
The root cause is that the storage container logic does not sufficiently validate user permissions. An attacker can send crafted network requests to the vulnerable endpoints and gain elevated privileges without authenticating first. The flaw is in the authorization logic that decides whether a user or service principal has the rights to perform actions on storage resources. Unauthorized actors may therefore be able to access, modify, or delete sensitive customer service data and system configurations.
As of the publication date, no public code snippets or detailed exploit chains are available for this vulnerability. The attack vector is network-based, and exploitation does not require local access or prior authentication.
Affected systems and versions
- Microsoft Dynamics OmniChannel SDK Storage Containers
- All versions prior to 1.11.0 are affected (support for versions before 1.11.0 ended November 1, 2025)
- Both cloud-hosted (Dynamics 365 Online) and on-premises deployments are potentially vulnerable
- Review custom integrations and third-party extensions that use the OmniChannel SDK for exposure
Vendor security history
Microsoft has addressed improper authorization vulnerabilities in its enterprise and cloud products before. Notable examples include:
- CVE-2025-26683 (Azure Playwright improper authorization)
- CVE-2025-62206 (Dynamics 365 on-premises information disclosure)
Microsoft typically releases security patches in its monthly Patch Tuesday cycle and publishes detailed advisories through the Microsoft Security Response Center (MSRC). The company runs a public vulnerability disclosure program and has responded in a timely way to critical security issues in its cloud and enterprise platforms.
