CVE-2026-42898

The vulnerability is caused by improper control of code generation (CWE-94 — Improper Control of Generation of Code). An attacker with an account in the system can submit specially crafted data over the network, which is then interpreted and executed as code by the application. The network attack vector with low complexity and no required user interaction significantly lowers the threshold for exploiting the vulnerability. The attack scope extends beyond the vulnerable component, meaning the ability to impact resources outside the direct Dynamics 365 environment.

An attacker can gain full control of the system through remote code execution, leading to violation of confidentiality, integrity, and availability of data and infrastructure.

Apply patches available from the vendor according to references published in Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898

Microsoft Dynamics 365 (on-premises) — specific versions indicated in vendor references (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898)