What is the CVSS score of CVE-2026-42833?

CVE-2026-42833 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Dynamics 365 are affected by CVE-2026-42833?

Microsoft Dynamics 365 on-premises (versions 9.0 and 9.1) contains a critical remote code execution vulnerability exploitable by high-privileged administrators, enabling complete system compromise…. A patch is available.

How to fix or mitigate CVE-2026-42833?

Within 24 hours, conduct a comprehensive inventory of all Microsoft Dynamics 365 on-premises deployments running version 9.0 or 9.1, documenting scope and business criticality. Within 7 days, apply vendor patch version 9.1.44.15 or later to all identified production instances after validating the update in a staging environment to ensure business process continuity. Within 30 days, complete patch deployment across development and test environments, and verify remediation using Microsoft's update verification tools to confirm all instances are running version 9.1.44.15 or later.

Microsoft Dynamics 365 CVE-2026-42833

EUVD-2026-29713 CRITICAL

Execution with Unnecessary Privileges (CWE-250)

2026-05-12 microsoft

GHSA-wq97-r6xw-c5c9

Privilege Escalation Microsoft Microsoft Dynamics 365 On Premises Version 9 1

9.1

CVSS 3.1 · NVD

Temporal: 7.9

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

7.9 HIGH

cvss

vuln.today AI

9.1 CRITICAL

Network-reachable code execution with low complexity but requiring an existing high-privileged account (PR:H); over-privileged execution crosses a security boundary (S:C) with total confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:03 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

CRITICAL 9.1

DescriptionCVE.org

Execution with unnecessary privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Dynamics 365 (on-premises) version 9.1 (and 9.0 builds prior to 9.1.44.15) allows an authenticated, high-privileged attacker to run arbitrary code over the network because the application executes with unnecessary privileges (CWE-250). Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is very low (0.07%) and CISA SSVC records no known exploitation, so this is a high-CVSS but not currently exploited issue. The scope-changed CVSS 9.1 reflects that successful code execution can impact resources beyond the vulnerable component's original security authority.

Technical ContextAI

Microsoft Dynamics 365 (on-premises) is Microsoft's self-hosted CRM/ERP business-application platform, typically deployed on Windows Server with IIS and SQL Server backends inside enterprise networks. The root cause is CWE-250 (Execution with Unnecessary Privileges): a component of the application performs an operation using a higher privilege level than required, so an operation reachable by an authorized user runs in an over-privileged context. The CPE identifies the affected build as cpe:2.3:a:microsoft:microsoft_dynamics_365_(on-premises)_version_9.1. Because the CVSS scope is Changed (S:C), the vulnerable component and the impacted component differ - code executing with the excess privileges can affect resources managed by a different security authority (for example the underlying service account or host), which is characteristic of privilege-boundary failures.

RemediationAI

Apply the Microsoft-released update that brings Dynamics 365 (on-premises) to build 9.1.44.15 or later, as tracked in the MSRC advisory (Vendor-released patch: 9.1.44.15) at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42833; this is the primary and authoritative fix. Because exploitation requires an authorized high-privileged account, interim compensating controls include tightening who holds elevated Dynamics roles and administrative accounts, reviewing and reducing the privileges of the service/application accounts under which the platform runs (directly addressing the unnecessary-privileges root cause), and restricting network reachability of the Dynamics application endpoints to trusted internal segments or VPN only rather than broad exposure. The trade-off of network restriction is reduced accessibility for legitimate remote or partner users, and privilege reduction should be tested in staging to avoid breaking integrations that currently depend on the over-privileged context; none of these substitute for the patch, which should be applied as soon as change control allows.