EUVD-2026-29718
GHSA-f8w6-8hpv-rrjj
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Remote code execution in Microsoft Dynamics 365 (on-premises) versions 9.0 and 9.1 (prior to 9.1.44.15) lets an authenticated attacker inject and execute arbitrary code across the network with a scope change beyond the vulnerable component. Rated CVSS 9.9, the flaw yields total confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.07%, 21st percentile). Microsoft has released a fixed build (9.1.44.15).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Microsoft Dynamics 365 On Premises Version 9 1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
Articles & Coverage 1
Executive ViewAI
Microsoft Dynamics 365 (on-premises) versions 9.0 through 9.1.44.14 contain a remote code execution vulnerability (CVSS 9.9) enabling authenticated attackers to execute arbitrary code with full system impact across the network. Although exploitation probability is exceptionally low (0.07% EPSS) and no public exploit exists, this threatens critical enterprise resource planning infrastructure and requires immediate patching.
Within 24 hours, inventory all on-premises Dynamics 365 deployments to identify systems running versions 9.0 or 9.1 prior to 9.1.44.15 and document network access controls limiting authenticated users. Within 7 days, test Microsoft's released patch (build 9.1.44.15) in staging and deploy to production instances, beginning with systems connected to sensitive financial or operational data. Within 30 days, verify complete deployment through administrative audit reports confirming all systems report version 9.1.44.15 or later.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB