What is the CVSS score of EUVD-2026-95397?

EUVD-2026-95397 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Which versions of Microsoft Dataverse are affected by EUVD-2026-95397?

A critical deserialization flaw in Microsoft Dataverse (CVE-2026-88131, CVSS 9.8) could let an unauthenticated remote attacker execute arbitrary code against business applications and data hosted in…. A patch is available.

How to fix or mitigate EUVD-2026-95397?

Within 24 hours, confirm with Microsoft (via the tenant admin center or your account team) whether the server-side fix for CVE-2026-88131 has been applied to every Dataverse environment in your tenant, and inventory all Dataverse environments, custom plug-ins, connectors, and service principals that could exercise untrusted deserialization paths; simultaneously review Dataverse and Power Platform audit logs for anomalous anonymous API calls, unexpected code execution, or unusual data exfiltration patterns. Within 7 days, ensure any self-managed or on-premises components in the Power Platform/Dynamics stack (for example on-premises data gateways or Dynamics 365 on-premises deployments) are updated to the vendor-released versions named in Microsoft's advisory, restrict anonymous and public access to Dataverse OData and Web APIs, enforce conditional access and least-privilege roles for service principals, and disable unused custom plug-ins and workflows. Within 30 days, validate that patch coverage is complete across all environments and regions, run a targeted review of deserialization handling in custom code and third-party solutions built on Dataverse, add detections for post-exploitation behavior and re-check CISA KEV and Microsoft advisories for any change in exploitation status, and confirm that incident response playbooks cover a cloud-hosted RCE scenario of this type.

Microsoft Dataverse EUVD-2026-95397

| CVE-2026-88131 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-10-08 microsoft

GHSA-hvxr-qwg3-rpr3

Deserialization Microsoft Microsoft Dataverse

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

CRITICAL

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization (CWE-502) yields AV:N/AC:L/PR:N/UI:N with full C/I/A loss from arbitrary code execution; no cross-system scope change indicated, so S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 23:02 vuln.today

CVE Published

Oct 08, 2026 - 22:15 cve.org

CRITICAL 9.8

DescriptionNVD

Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.

AnalysisAI

Unauthorized remote code execution is possible in Microsoft Dataverse through deserialization of untrusted data, scored 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:N and UI:N, the vulnerable deserialization path can be reached by remote attackers without authentication, user interaction, or special configuration. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The description provides no specific triggering feature, protocol, or configuration setting - it states only that untrusted data is deserialized, allowing unauthorized network code execution. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All provided signals point to a high-severity flaw but temper the real-world urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Patch available per vendor advisory: the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88131 is marked as available from the vendor, and per the RL:O metric the fix is an official remedy delivered server-side by Microsoft, so there is no customer-installed patch version to cite and no exact fixed build number is published in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, confirm with Microsoft (via the tenant admin center or your account team) whether the server-side fix for CVE-2026-88131 has been applied to every Dataverse environment in your tenant, and inventory all Dataverse environments, custom plug-ins, connectors, and service principals that could exercise untrusted deserialization paths; simultaneously review Dataverse and Power Platform audit logs for anomalous anonymous API calls, unexpected code execution, or unusual data exfiltration patterns. …

Threat intelligence, references, and detailed analysis are available after sign-in.