This vulnerability (CVE-2026-42898) in Microsoft Dynamics 365 (on-premises) version 9.1 involves improper control of code generation, classified as CWE-94 (Code Injection). It enables an authorized attacker to execute arbitrary code remotely over a network. The CVSS 3.1 base score is 9.9, reflecting critical severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality, integrity, and availability with a scope change. Microsoft has issued an official fix and manages remediation for the cloud service version. The vendor advisory is available at the Microsoft Security Response Center.

An authorized attacker can exploit this vulnerability to execute arbitrary code remotely on affected Microsoft Dynamics 365 (on-premises) systems. This can lead to complete compromise of the affected system, including full control over data confidentiality, integrity, and availability. The vulnerability has a critical CVSS score of 9.9, indicating severe potential impact if exploited.

An official fix is available from Microsoft. Users should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898. Since this is a cloud service, Microsoft manages remediation for the cloud-hosted service. Check the vendor advisory for the latest remediation guidance and ensure systems are updated promptly.