CVE-2026-42833

Critical · 9.1

CVSS

9.1

EPSS

0.9%

Published

May 12, 2026

CISA due date

—

The record

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

Affected packages

Ecosystem	Package	Introduced	Fixed