Microsoft Dynamics 365 On‑Premises accepts serialized payloads from the network. When that data is deserialized without proper validation, an attacker who has legitimate access can inject malicious objects that are executed during deserialization, leading to code execution on the server. This flaw can compromise confidentiality, integrity, and availability by allowing the attacker to run arbitrary commands.

The vulnerability affects the on‑premises deployment of Microsoft Dynamics 365 version 9.1. Only the on‑premises edition, as indicated by the product name and version in the vendor information, is impacted. No other Dynamics 365 platforms or versions are listed as affected.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, meaning no publicly known active exploits are reported yet. However, the description indicates that an attacker with authorized credentials can craft data and transmit it over the network. Inference suggests that the attack vector is remote, and access to the affected system is required. Even without an active exploit, the combination of high severity and network accessibility places the risk at a substantial level. Prompt remediation is advised.