Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Microsoft Dynamics 365 (on-premises) version 9.1. This vulnerability allows an authorized attacker with System Administrator privileges to execute code over the network. The issue arises from the application executing code with unnecessary privileges, which could be exploited by manipulating data related to background operations. When this data is processed, it may be deserialized without proper validation, enabling the execution of unauthorized commands on the CRM server.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution on the server where Microsoft Dynamics 365 is hosted.

Remediation

Users can download the security update for Microsoft Dynamics 365 (on-premises) version 9.1 from the Microsoft Support website. Knowledge Base Article 5078943 provides additional information about this update.