CVE-2026-65772 – Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Microsoft Dynamics 365 (on-premises) version 9.1 contains a remote code execution vulnerability caused by deserialization of untrusted data. An authorized attacker with low privileges can exploit the issue over a network with low attack complexity and without user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability provides a network-accessible path to remote code execution. Exploitation requires low privileges but no user interaction, and a successful attack can result in high confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, and exploitation is assessed as less likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is associated with CWE-502, Deserialization of Untrusted Data. Microsoft Dynamics 365 can deserialize untrusted data in a manner that allows an authorized attacker to execute code over a network. The attack has low complexity, requires low privileges, and requires no user interaction. Scope remains unchanged, while successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Microsoft Dynamics 365 (on-premises) version 9.1 is affected. An attacker with low privileges can exploit the vulnerability remotely over a network without user interaction. Exploitation is assessed as less likely.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code remotely, potentially exposing sensitive business information, modifying data, and disrupting Dynamics 365 availability. For organizations relying on on-premises Dynamics 365 for critical operations, compromise could affect both business data and service continuity.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified, and customer action is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its network attack vector, low attack complexity, low privilege requirement, and absence of required user interaction make timely deployment important, even though exploitation is currently assessed as less likely and no exploitation is reported.