CVE-2026-42898

—

CVSS 3.1

9.9 critical

EPSS

1%p66

Published

May 12, 2026 (May 12, 2026)

Modified

Jun 17, 2026

Description

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

Vendors: microsoft
Products: dynamics 365
Weakness: CWE-94
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news6 stories

Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws

The Hacker NewsMay 15, 00:00 UTC · May 15, 2026Vulnerability in the wildCVE-2025-54518 CVE-2026-41096 CVE-2026-42826+14 CVEs1

Microsoft Patch Tuesday for May 2026 fix 138 bugs, some of them are alarming

Security AffairsMay 13, 19:28 UTC · May 13, 2026Vulnerability in the wildCVE-2026-42898 CVE-2026-41089 CVE-2026-41096+4 CVEs

Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities

Cisco TalosMay 13, 15:34 UTC · May 13, 2026Vulnerability in the wildCVE-2026-32161 CVE-2026-33109 CVE-2026-33844+22 CVEs

Microsoft on pace to break annual vulnerability record as AI

The RecordMay 13, 12:59 UTC · May 13, 2026Vulnerability in the wildCVE-2026-41089 CVE-2026-41096 CVE-2026-42898

Microsoft Fixes 17 Critical Flaws in May Patch Tuesday

Infosecurity MagazineMay 13, 08:15 UTC · May 13, 2026Vulnerability CVE-2026-41089 CVE-2026-41096 CVE-2026-42898

Microsoft addresses 137 vulnerabilities in May’s Patch Tuesday, including 13 rated critical

CyberScoopMay 12, 21:00 UTC · May 12, 2026Vulnerability in the wildCVE-2026-33109 CVE-2026-42823 CVE-2026-42898+2 CVEs