Microsoft Dynamics 365 CVE-2026-65772

Exploitation requires a valid authenticated account with low privileges on the target Microsoft Dynamics 365 on-premises 9.1 installation running a build prior to 9.1.0046.0006. The attacker must have network access to the Dynamics 365 application server. The vulnerability applies to on-premises deployments only - Microsoft-managed cloud instances are outside the stated advisory scope. No elevated permissions or special role assignment beyond standard authenticated access is indicated as required; no user interaction is needed (UI:N). The primary limiting factor is possession of any valid Dynamics 365 credential, which rules out fully unauthenticated remote exploitation from the internet against properly firewalled deployments.

The CVSS 8.8 score reflects network-accessible exploitation (AV:N), low complexity (AC:L), low-privilege authentication (PR:L), no user interaction (UI:N), and full CIA triad impact - a high-severity combination. The PR:L requirement means a valid Dynamics 365 user account is necessary, which is a non-trivial barrier in fully external attack scenarios but routinely achievable through phishing, credential stuffing, or insider threats in enterprise environments where Dynamics 365 handles sensitive business data. EPSS data was not provided in the available intelligence; without a KEV listing or known public exploit, widespread opportunistic exploitation cannot be confirmed at this time, though CWE-502 deserialization vulnerabilities in .NET applications are well-understood by red teams and threat actors, and weaponization timelines post-disclosure tend to be short. The CVSS vector is internally consistent with the described attack (network, low priv, RCE), and the on-premises deployment scope means Microsoft cannot push patches automatically - defenders must apply updates manually, increasing the window of exposure.

An attacker who has obtained valid low-privilege Dynamics 365 credentials (via phishing or credential reuse) sends a crafted HTTP request containing a malicious serialized .NET object to a vulnerable on-premises Dynamics 365 endpoint. The server deserializes the payload without adequate validation, triggering a gadget chain that executes arbitrary code in the context of the application service account. No public exploit has been identified at time of analysis, but .NET deserialization tooling such as ysoserial.net is widely available, lowering the skill barrier for a knowledgeable attacker.