A critical code injection vulnerability in Microsoft Dynamics 365 (on-premises) allows authenticated users to achieve remote code execution, threatening internal system integrity.

This is a code injection flaw (CWE-94) that permits an attacker with low-level privileges (per CVSS vector PR:L) to execute code in the context of the application over a network.

With a CVSS score of 9.9, this vulnerability presents a high risk of unauthorized system access and potential data exfiltration. Because it allows code execution, an attacker could manipulate business logic, corrupt databases, or pivot to other systems within the internal network, leading to significant operational disruption.

Immediate Action: Apply the latest security updates provided by Microsoft to reach or exceed version 9.1.45.11.

Proactive Monitoring: Review application-level access logs for anomalous execution patterns or unauthorized modifications to system configurations.

Compensating Controls: Enforce strict least-privilege access policies to limit the potential pool of users who could exploit this vulnerability.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

While this vulnerability requires prior authentication, the high severity score and potential for full system compromise warrant immediate patching. Organizations should prioritize updating their on-premises Dynamics 365 environments during the next maintenance window.