CVE-2026-42898: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Overview

Severity
Critical (CVSS 9.9)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Remote Code Execution
Exploit Status
Not Exploited
Exploitation Likelihood
Unlikely
Patch Tuesday
2026-May
Released
2026-05-12

Description

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

FAQ

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability? Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges. According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability? An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities. How could an attacker exploit this vulnerability? An attacker with the required permissions could modify the saved state of a process session in Dynamics CRM and trigger the system to process that data, which could result in the server unintentionally executing malicious code.

Affected Products (1)

Microsoft Dynamics

  • Microsoft Dynamics 365 (on-premises) version 9.1

Security Updates (1)

Acknowledgments

<a href="https://twitter.com/hoangnx99">hoangha</a> with <a href="https://lab.viettelcybersecurity.com/">VCSLab of Viettel Cyber Security</a>, Butterfly

Revision History

  • 2026-05-12: Information published.