Description

Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T17:19:01.157Z",
  "pubdate": "2026-08-11T17:19:01.157Z",
  "executiveSummary": "A deserialization of untrusted data vulnerability exists within Microsoft Dynamics 365 (on-premises). This security flaw permits an authorized adversary to achieve remote code execution over a network. The vulnerability poses a severe risk to organizational infrastructure, as successful exploitation compromises the confidentiality, integrity, and availability of the affected host system. Threat actors possessing network access and authorization to interact with the vulnerable application can leverage this flaw to execute arbitrary commands or code within the context of the service account. Remediation requires strict adherence to vendor-supplied patches and implementation of defense-in-depth measures to restrict unauthorized data ingestion and network exposure.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure deserialization practices within Microsoft Dynamics 365 (on-premises). The application processes serialized objects from untrusted sources without performing adequate validation, type checking, or cryptographic integrity verification prior to instantiation. When an authorized attacker transmits a specifically crafted malicious serialized payload over the network to the vulnerable endpoint, the application deserializes the input object. During the deserialization routine, embedded method calls, gadget chains, or state restoration logic are triggered automatically by the underlying runtime environment. This execution flow bypasses standard application-layer security controls, forcing the application to instantiate arbitrary classes and invoke methods defined within the payload. Consequently, the attacker achieves arbitrary code execution within the operating system process space of the Dynamics 365 service. Exploitation requires network connectivity to the target on-premises instance and valid credentials or authorization to interact with the vulnerable component, enabling the adversary to pivot deeper into the internal network, escalate privileges locally, or exfiltrate sensitive enterprise data stored within the Dynamics 365 database."
}