This vulnerability, identified as CWE-94 (Improper Control of Generation of Code), affects Microsoft Dynamics 365 (on-premises) version 9.1, specifically version 9.0. It allows an authorized attacker to execute arbitrary code remotely over a network. The vulnerability is critical with a CVSS 3.1 base score of 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at the Microsoft Security Response Center.

An authorized attacker can execute arbitrary code remotely on affected Microsoft Dynamics 365 (on-premises) systems, potentially leading to full compromise of confidentiality, integrity, and availability of the system. This could allow unauthorized actions within the application and underlying system.

An official fix is available from Microsoft. Since this is a cloud-hosted service, Microsoft manages the remediation process. Users should apply the official update as directed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898 to mitigate this vulnerability.