CVE-2026-42898
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
Risk Assessment
An attacker with appropriate permissions can exploit this vulnerability to execute code remotely, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update Microsoft Dynamics 365 to the latest version to mitigate this vulnerability and to review and restrict user permissions.
Other vulnerabilities in Microsoft Dynamics 365 (on-premises)
See all- CVE-2024-21395High
XSS vulnerability in Microsoft Dynamics 365 (on-premises) allows injection of malicious script. Attacker can execute script in victim's browser.
- CVE-2024-21393High
XSS vulnerability in Microsoft Dynamics 365 (on-premises) allows injection of malicious script into victim's browser. Attacker can steal data or hijack session.
- CVE-2024-21389High
XSS vulnerability in Microsoft Dynamics 365 (on-premises) allows injection of malicious script. Attacker can execute script in victim's context.
- CVE-2023-35389Medium
A vulnerability in Microsoft Dynamics 365 On-Premises allows for remote code execution. An attacker can exploit this flaw to run unauthorized code on the server.
- CVE-2023-35335High
A vulnerability in Microsoft Dynamics 365 (on-premises) allows attackers to perform Cross-site Scripting (XSS) attacks. Exploiting this flaw may lead to the execution of malicious code in the user's browser context.
- CVE-2023-33171High
A vulnerability in Microsoft Dynamics 365 (on-premises) allows attackers to perform Cross-site Scripting (XSS) attacks. Exploiting this flaw could lead to the execution of malicious code in the user's browser context.
Original NVD description (English source)
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS