What is the CVSS score of CVE-2026-42898?

CVE-2026-42898 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Dynamics 365 On Premises Version 9 1 are affected by CVE-2026-42898?

Microsoft Dynamics 365 (on-premises) versions 9.0 through 9.1.44.14 contain a remote code execution vulnerability (CVSS 9.9) enabling authenticated attackers to execute arbitrary code with full…. A patch is available.

How to fix or mitigate CVE-2026-42898?

Within 24 hours, inventory all on-premises Dynamics 365 deployments to identify systems running versions 9.0 or 9.1 prior to 9.1.44.15 and document network access controls limiting authenticated users. Within 7 days, test Microsoft's released patch (build 9.1.44.15) in staging and deploy to production instances, beginning with systems connected to sensitive financial or operational data. Within 30 days, verify complete deployment through administrative audit reports confirming all systems report version 9.1.44.15 or later.

Microsoft Dynamics 365 On Premises Version 9 1 CVE-2026-42898

EUVD-2026-29718 CRITICAL

Code Injection (CWE-94)

2026-05-12 microsoft

GHSA-f8w6-8hpv-rrjj

RCE Microsoft Code Injection Microsoft Dynamics 365 On Premises Version 9 1

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:30 vuln.today

CVE Published

May 12, 2026 - 16:59 nvd

CRITICAL 9.9

DescriptionCVE.org

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

Articles & Coverage 1

blog.talosintelligence.com Microsoft May 2026 Patch Tuesday: 31 Critical RCE Vulnerabilities Including Windows, Office, Azure May 12, 2026

AnalysisAI

Remote code execution in Microsoft Dynamics 365 (on-premises) versions 9.0 and 9.1 (prior to 9.1.44.15) lets an authenticated attacker inject and execute arbitrary code across the network with a scope change beyond the vulnerable component. Rated CVSS 9.9, the flaw yields total confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.07%, 21st percentile). Microsoft has released a fixed build (9.1.44.15).