Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.
According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
How could an attacker exploit this vulnerability?
An attacker with the required permissions could modify the saved state of a process session in Dynamics CRM and trigger the system to process that data, which could result in the server unintentionally executing malicious code.
Security updates
9.1.45.11 — https://support.microsoft.com/help/5078943
Vulnerabilities 1
-
Critical 9.9
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
Revision history
-
#4
Updated an acknowledgement. This is an informational change only.
-
#2
Acknowledgement Updated
-
#3
Updated the fixed version number. This is an informational change only.
-
#1
Information published.
References
-
CVE-2026-42898 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss