CVE-2026-77908: CWE-94: Improper Control of Generation of Code ('Code Injection') in Microsoft Microsoft Dynamics 365 Customer Engagement V9.1

This vulnerability (CVE-2026-77908) involves improper control of code generation (CWE-94) in Microsoft Dynamics 365 Customer Engagement V9.1. An authorized attacker can exploit this flaw to execute arbitrary code remotely over a network. The vulnerability affects versions >=9.0 and <9.1.0048.0004. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. Given the cloud service nature, the impact could affect hosted customer environments until patched.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Microsoft Dynamics 365 Customer Engagement service. Customers should ensure their service instances are updated to the fixed version (>=9.1.0048.0004) as per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77908. No additional action is required beyond applying the official update.