SB2026090874 - Remote code execution in Microsoft Dynamics 365 On

Cybersecurity-Help.Cz • September 9, 2026

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in Microsoft Dynamics 365 On-Premises. A remote user can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Remote Code Execution Vulnerabilities in Microsoft Dynamics 365 On-Premises Two critical vulnerabilities (SB2026090874 and SB2026090875) have been identified in Microsoft Dynamics 365 On-Premises, allowing remote attackers to execute arbitrary code on affected systems. Both vulnerabilities stem from improper input validation when processing serialized data, enabling attackers to compromise systems completely. The vulnerabilities affect all versions of Microsoft Dynamics 365 On-Premises. Successful exploitation could lead to severe security breaches. Users are advised to install updates from the vendor's website to mitigate these risks. No specific CVEs were mentioned in the articles. The vulnerabilities were reported on the same day, indicating a potentially coordinated disclosure. Organizations using Microsoft Dynamics 365 On-Premises should prioritize patching to prevent exploitation. 5 sources 71

Extracted Entities

SB2026090874 - Remote code execution in Microsoft Dynamics 365 On

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)