CVE-2026-77908: Microsoft Dynamics 365

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

Affected products

• Microsoft Dynamics 365: before 9.1.0048.0004 (fixed in 9.1.0048.0004)

Published 2026-09-08. Last modified 2026-09-29.