This vulnerability (CVE-2026-77908) involves improper control of code generation (CWE-94) in Microsoft Dynamics 365 Customer Engagement V9.1. An authorized attacker can exploit this flaw to execute arbitrary code remotely over a network. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability affects version 9.0 of the product. Microsoft has issued an official fix and manages remediation for this cloud-hosted service. No known active exploitation has been reported.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. Given the high CVSS score and the nature of code injection, the impact is significant for affected environments.

An official fix is available from Microsoft. Since Microsoft Dynamics 365 Customer Engagement is a cloud service, Microsoft manages the remediation server-side. Users should consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77908 for detailed patching and mitigation instructions. No additional user action is required beyond applying the official fix as directed by Microsoft.