Product:
Microsoft Dynamics 365
Summary
Improper control of generation of code in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network. This vulnerability can lead to significant impacts on confidentiality, integrity, and availability. Attackers can exploit this flaw to gain unauthorized access and execute malicious code.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.9 | CVE-2026-42898 |
Exploitation
To exploit this vulnerability, an attacker must have authorized access to the system. They can then send specially crafted requests over the network that trigger the code injection flaw, allowing them to execute arbitrary code. The low attack complexity means that even users with minimal technical skills can potentially exploit this vulnerability if they have the necessary access.
Affected Products
- Microsoft Dynamics 365 (on-premises): Affected by code injection vulnerability allowing unauthorized code execution.
Mitigation
To mitigate this vulnerability, it is essential to apply the latest security updates provided by Microsoft. Additionally, organizations should implement strict access controls and monitor network traffic for any suspicious activities. Regular security assessments can help identify and remediate potential vulnerabilities.