Microsoft Dynamics 365 EUVD-2026-29713

Exploitation requires an authenticated attacker holding high privileges within Microsoft Dynamics 365 (on-premises) - per CVSS PR:H - reachable over the network (AV:N) with no user interaction (UI:N) and low complexity (AC:L). The concrete prerequisite is a valid high-privileged Dynamics account (or a compromised administrative/service identity) able to invoke the over-privileged code path on an affected build (version 9.1, or 9.0 below 9.1.44.15). Limiting factors that reduce real-world risk: the PR:H barrier means an unprivileged or anonymous attacker cannot exploit this directly, exploitation is confined to the specified on-premises versions (cloud Dynamics 365 online is not indicated), and CISA SSVC marks it Automatable: no, indicating it is not readily wormable or mass-scannable.

The signals are consistent and point to a serious-in-theory but not-yet-exploited flaw. CVSS 3.1 is 9.1 (AV:N, AC:L, PR:H, UI:N, S:C, C:H/I:H/A:H): network-reachable with low complexity and no user interaction, but requiring high privileges (PR:H) to exploit - a meaningful barrier. EPSS is only 0.07% (22nd percentile) and CISA SSVC records Exploitation: none and Automatable: no, while rating Technical Impact: total. These agree: high potential damage, low current likelihood. There is no KEV listing and no public exploit identified at time of analysis. The main tension is between the 9.1 'critical' score and the low real-world exploitation probability - the score is driven by scope change and total impact, but the PR:H requirement (attacker must already hold high privileges) plus Automatable:no substantially limit mass exploitation. Treat as a prioritized patch for internet- or intranet-exposed on-premises Dynamics servers, but not an emergency on the level of an unauthenticated pre-auth RCE.

An attacker who has obtained a high-privileged Dynamics 365 account - for example a compromised administrator or a malicious insider - sends crafted requests over the network to an on-premises Dynamics server and triggers the over-privileged code path, causing arbitrary code to execute in a context with more privileges than the operation should have. Given the scope change, this can pivot to resources or a security context beyond the original application boundary. No public proof-of-concept exists at time of analysis, and low attack complexity (AC:L) means that for an attacker who already meets the privilege prerequisite, exploitation is straightforward.