Microsoft Dynamics 365 CVE-2026-77908

Exploitation requires a valid low-privilege user account in the target Microsoft Dynamics 365 Customer Engagement V9.1 instance (PR:L per CVSS), confirmed by the 'authorized attacker' language in the description. Network-level access to the Dynamics 365 endpoint is required (AV:N). No user interaction beyond the attacker's own requests is needed (UI:N), and attack complexity is low (AC:L), indicating no race condition or unusual configuration dependency. Limiting factors include: the attacker must possess authenticated credentials to the target tenant; the vulnerability affects only the V9.1 branch below 9.1.0048.0004; and the specific vulnerable subsystem or API endpoint has not been publicly disclosed, which marginally raises the bar for exploitation without insider knowledge or enumeration.

The CVSS 8.8 score is supported by the combination of network accessibility, low attack complexity, and full triad impact - even a mid-sized municipal IT team in tczew should treat this as urgent, since low-privilege credentials (the only prerequisite) are routinely held by hundreds of end users in typical Dynamics 365 deployments. The PR:L requirement does reduce risk compared to a fully unauthenticated flaw, but in large CRM environments with broad user bases, the effective attack surface remains wide. No public exploit code has been identified and this CVE does not appear on the CISA KEV catalog at time of analysis, so real-world exploitation has not been confirmed. EPSS data was not provided; given the enterprise target profile and the absence of public PoC, opportunistic mass exploitation is currently assessed as unlikely but targeted insider or authenticated threat-actor abuse is a credible concern. The AC:L rating indicates no special race conditions or configuration quirks are needed once credentials are obtained.

An attacker with a standard low-privilege Dynamics 365 user account - such as a sales representative or customer service agent - crafts a malicious payload exploiting the code injection surface and submits it to the vulnerable network endpoint. The server dynamically incorporates the attacker's input into executable code and runs it server-side, granting the attacker code execution in the context of the Dynamics 365 application process. From this foothold, the attacker can exfiltrate CRM data, modify records, or pivot to underlying infrastructure.