Microsoft Dynamics 365 On Premises Version 9 1
Monthly
Remote code execution in Microsoft Dynamics 365 (on-premises) version 9.1 (and 9.0 builds prior to 9.1.44.15) allows an authenticated, high-privileged attacker to run arbitrary code over the network because the application executes with unnecessary privileges (CWE-250). Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is very low (0.07%) and CISA SSVC records no known exploitation, so this is a high-CVSS but not currently exploited issue. The scope-changed CVSS 9.1 reflects that successful code execution can impact resources beyond the vulnerable component's original security authority.
Remote code execution in Microsoft Dynamics 365 (on-premises) versions 9.0 and 9.1 (prior to 9.1.44.15) lets an authenticated attacker inject and execute arbitrary code across the network with a scope change beyond the vulnerable component. Rated CVSS 9.9, the flaw yields total confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.07%, 21st percentile). Microsoft has released a fixed build (9.1.44.15).
Remote code execution in Microsoft Dynamics 365 (on-premises) version 9.1 (and 9.0 builds prior to 9.1.44.15) allows an authenticated, high-privileged attacker to run arbitrary code over the network because the application executes with unnecessary privileges (CWE-250). Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is very low (0.07%) and CISA SSVC records no known exploitation, so this is a high-CVSS but not currently exploited issue. The scope-changed CVSS 9.1 reflects that successful code execution can impact resources beyond the vulnerable component's original security authority.
Remote code execution in Microsoft Dynamics 365 (on-premises) versions 9.0 and 9.1 (prior to 9.1.44.15) lets an authenticated attacker inject and execute arbitrary code across the network with a scope change beyond the vulnerable component. Rated CVSS 9.9, the flaw yields total confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.07%, 21st percentile). Microsoft has released a fixed build (9.1.44.15).