The vulnerability results from an improper control of code generation processes that permits authorized users to supply malicious code that is subsequently executed in the server context. This leads to complete compromise of confidentiality, integrity, and availability of the Dynamics 365 instance, as an attacker can run arbitrary code on the server over the network. The weakness is a classic code injection flaw (CWE‑94).

The flaw affects Microsoft Dynamics 365 On‑Premises version 9.1. Users running this version on any environment must confirm that the system has the latest update applied; no other versions are currently listed.

The CVSS score of 9.9 indicates critical severity, and the vulnerability is listed on Microsoft's Security Update Guide, but no EPSS score is provided. The vulnerability requires the attacker to already be authorized to the application, meaning an internal or compromised account is likely needed. Because the flaw enables remote code execution, an attacker who can exploit it will have full control of the affected server. The CISA KEV catalog does not list it, so no known widespread exploitation at this time.