The vulnerability permits execution with unnecessary privileges in Microsoft Dynamics 365 (on-premises), enabling an attacker with authorized access to run arbitrary code over a network. This flaw directly leads to a remote code execution impact, compromising both confidentiality and integrity of the system.

Microsoft Dynamics 365 (on-premises) version 9.1 is affected.

The CVSS score of 9.1 classifies this as a critical severity vulnerability. The EPSS score of 0.00071 indicates a very low but non‑zero probability of exploitation, and the issue is not listed in CISA KEV, so there is no published exploit evidence yet. An attacker must already possess authorized credentials to exploit the flaw, indicating that privileged users or compromised accounts could gain full control of the application server. The attack vector is network‑based, meaning the vulnerability can be triggered from within the corporate network or over a remote connection if the attacker obtains suitable credentials.