Execution with unnecessary privileges in Microsoft Dynamics 365 (on-premises)

Successful exploitation allows an authenticated/authorized attacker with high privileges to execute code remotely against a vulnerable Microsoft Dynamics 365 (on-premises) deployment. The provided CVSS v3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates low attack complexity, no user interaction, scope change, and high impact to confidentiality, integrity, and availability. The mention context also indicates the attacker may gain the ability to interact with other tenants’ applications and content, implying potential cross-tenant impact and broad compromise of application data and operations.

If immediate patching is not possible, reduce exposure by restricting network access to Microsoft Dynamics 365 (on-premises) instances, limiting access to trusted administrative and application users only, reviewing and minimizing privileged accounts, enforcing strong access controls and MFA where applicable, segmenting the environment, and monitoring for suspicious authenticated activity against Dynamics 365. The available content does not provide an official vendor-specific workaround.

Apply Microsoft's security update for CVE-2026-42833 via the Microsoft Security Response Center guidance for Microsoft Dynamics 365 (on-premises): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42833. No more detailed product-version-specific remediation steps were provided in the available content.