CVE-2026-42833: Microsoft Dynamics 365

Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days.

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

Affected products

• Microsoft Dynamics 365: from 9.1, before 9.1.45.11 (fixed in 9.1.45.11)

Published 2026-05-12. Last modified 2026-06-17.