This vulnerability in Microsoft Dynamics 365 (on-premises) version 9.1 arises from improper control of code generation, categorized under CWE-250. It enables an authorized attacker to execute code remotely over a network with elevated privileges. The CVSS 3.1 base score is 9.1, indicating a critical severity with high impact on confidentiality, integrity, and availability. Microsoft has released an official fix and manages remediation for the cloud service. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely with elevated privileges, potentially compromising confidentiality, integrity, and availability of the affected system. This could lead to full system compromise within the scope of the affected Microsoft Dynamics 365 (on-premises) environment.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42833 to mitigate this vulnerability.