This vulnerability (CVE-2026-42898) involves improper control of code generation (CWE-94) in Microsoft Dynamics 365 (on-premises) version 9.1, enabling an authorized attacker to execute arbitrary code remotely. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. The affected version explicitly includes 9.0. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely on the affected Microsoft Dynamics 365 (on-premises) system. This can lead to full compromise of the system's confidentiality, integrity, and availability. The vulnerability is critical due to its high CVSS score and the potential for complete system control.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation server-side. Users should consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898 for detailed patching instructions and ensure their systems are updated to the fixed version. No additional mitigation steps are indicated by the vendor advisory.