This vulnerability (CVE-2026-65815) involves improper deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) version 9.1, specifically affecting version 9.0. An attacker with authorized access can exploit this flaw to execute arbitrary code remotely over a network. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65815.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability with high severity as indicated by the CVSS score of 8.8.

An official fix is available from Microsoft and should be applied promptly. Since this is a cloud-hosted service, Microsoft manages remediation server-side. Users should consult the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65815 for detailed patching instructions and ensure their systems are updated to the fixed version.