9.9 CriticalCWE-94
CVE-2026-42898
Microsoft Dynamics 365 (on-premises) version 9.1 vulnerability
MicrosoftMicrosoft Dynamics 365 (on-premises) version 9.1
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 20 Oct
1.0%probability of exploitation in the next 30 days
Higher than 62% of scored CVEs
SeverityCVSS
9.9Critical
Description NVD
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
Coverage 4 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 12 May · 21:31 UTC | Dark Reading | Microsoft Patch May 2026 fixes 137 bugs, zero day free |
| Wed 13 May · 08:31 UTC | Infosecurity | Microsoft patches 120 bugs, flags critical Netlogon and DNS RCEs |
| Wed 13 May · 12:11 UTC | SOCRadar | May 2026 Patch Tuesday: 137 Vulnerabilities, No Zero-Days |
| Wed 13 May · 20:32 UTC | Security Affairs | Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming |
- Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarmingSecurity Affairs · mentions it in passing
- May 2026 Patch Tuesday: 137 Vulnerabilities, No Zero-DaysSOCRadar · mentions it in passing
- Microsoft patches 120 bugs, flags critical Netlogon and DNS RCEsInfosecurity · mentions it in passing
- Microsoft Patch May 2026 fixes 137 bugs, zero day freeDark Reading · first in our coverage