Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An attacker could exploit the vulnerability by sending specially crafted data that is processed by the vulnerable component, causing it to deserialize untrusted input and execute unintended actions within the service context.
Security updates
9.1.0047.0006 — https://support.microsoft.com/en-US/servicing/dynamics/crm/microsoft-dynamics-365-on-premises-cumulative-updates
Vulnerabilities 1
-
High 8.8
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-65815 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65815
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss