The updated description indicates that an authorized attacker can exploit improper code generation, allowing execution of arbitrary code over the network in Microsoft Dynamics 365 (on-premises). This flaw constitutes a remote code execution vulnerability, compromising confidentiality, integrity, and availability of the affected system.

Microsoft Dynamics 365 (on-premises) version 9.1 is affected.

The CVSS score of 9.1 classifies this as a critical severity vulnerability. The EPSS score of 0.00097 indicates a very low but non‑zero probability of exploitation, and the issue is not listed in CISA KEV, so there is no published exploit evidence yet. An attacker must already possess authorized credentials to exploit the flaw, indicating that privileged users or compromised accounts could gain full control of the application server. The attack vector is network‑based, meaning the vulnerability can be triggered from within the corporate network or over a remote connection if the attacker obtains suitable credentials.