Vulnerability intelligence

CVE-2026-42898

Microsoft Microsoft Dynamics 365 (on-premises) version 9.1 CWE-94

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

CVSS Score

9.9

Critical

EPSS — Exploit Probability

1.2%

Riskier than 66% of all CVEs · checked 2026-09-05

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

4 articles across 4 outlets · first covered May 12, 2026 · latest May 13, 2026

Coverage timeline

Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming
securityaffairs.com · May 13, 2026
May 2026 Patch Tuesday: 137 Vulnerabilities, No Zero-Days
socradar.io · May 13, 2026
Microsoft patches 120 bugs, flags critical Netlogon and DNS RCEs
www.infosecurity-magazine.com · May 13, 2026
Microsoft Patch May 2026 fixes 137 bugs, zero day free
www.darkreading.com · May 12, 2026

Related CVEs — Microsoft

CVE-2026-85880KEV CVE-2026-81963KEV CVE-2026-62878 CVE-2026-62893 CVE-2026-62823 CVE-2026-65789 CVE-2026-69414 CVE-2026-55007