CVE-2026-42898: Microsoft Dynamics 365

Critical severity, CVSS 9.9. EPSS: 1% chance of exploitation in the next 30 days.

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

Affected products

• Microsoft Dynamics 365: from 9.1.1.914, before 9.1.45.11 (fixed in 9.1.45.11)

Published 2026-05-12. Last modified 2026-06-17.