An authenticated remote code execution vulnerability in Microsoft Dynamics 365 poses a critical risk by allowing attackers to execute arbitrary SQL commands and potentially compromise the underlying operating system.

This vulnerability involves an insecure processing mechanism for .rdl files, which allows an authenticated user with specific privileges, or an attacker who can trigger an existing report, to execute arbitrary SQL commands. The attack vector is network based and requires low privileges to initiate the malicious report generation.

The ability to execute arbitrary SQL commands against the database presents a severe risk of unauthorized data exfiltration, modification, or total system compromise. Given the CVSS score of 8.8, this high-severity flaw could lead to full loss of confidentiality, integrity, and availability of the Dynamics environment. Furthermore, depending on the service account permissions, an attacker might escalate their access to the underlying host operating system.

Immediate Action: Review the official Microsoft security advisory for the latest security update and apply the corresponding patch to all on-premises Dynamics 365 instances.

Proactive Monitoring: Monitor SQL Server Reporting Services logs for suspicious .rdl file uploads and track unusual query patterns originating from the application service account.

Compensating Controls: Restrict the Add Reporting Services Reports privilege to highly trusted administrative accounts and employ a Web Application Firewall to inspect file uploads for malicious Report Definition Language structures.

Public Exploit Available: Yes, a published PoC exists, attributed to the technical write-up referenced by the CVE record.

This vulnerability represents a significant security risk due to the potential for remote code execution via SQL injection. Organizations should prioritize the identification of all on-premises Dynamics 365 deployments and ensure that all necessary security updates are applied immediately upon availability from Microsoft. Failure to patch these systems could allow malicious actors to gain unauthorized control over core business data and infrastructure.