Microsoft Dynamics 365 Customer Engagement (on-premises) version 1612 (9.0.2.3034) allows an attacker to upload a malicious RDL (Report Definition Language) file that contains raw SQL queries. When the Reporting Service processes the uploaded file, it executes the embedded SQL under the permissions of the SQL Server Reporting Services account. The vulnerability is a classic SQL Injection flaw (CWE‑89) and can lead to arbitrary data manipulation, untrusted data exposure, and, depending on the Reporting Services account rights, execution of linked server commands or even operating system commands. The impact is therefore high: confidentiality, integrity, and potential availability of the underlying database and, if broader privileges exist, the host server.

Affected product: Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034). The risk lies in the Reporting Services component that processes uploaded RDL files. No additional affected product versions are listed.

The CVSS score is 8.8, indicating a high severity vulnerability. The EPSS score is less than 1%, suggesting a low current exploit likelihood, and the issue is not listed in CISA’s KEV catalog. The attack requires the ability to upload or execute an RDL file with the Add Reporting Services Reports privilege, or if the file is already loaded and executable, privilege escalation is not mandatory. These conditions imply that the exploit vector is most likely remote via the web interface that manages reports, but it could also be local if an attacker gains file upload access. The actual exploitation path is clearly stated in the vendor description; no additional inference is needed beyond the stated conditions.