CVE-2026-42833

FAQ

According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to already have a high level of access, specifically a System Administrator role in Microsoft Dynamics 365 CRM. As a result, this issue cannot be exploited by an unauthenticated or low-privilege user and would only be relevant to users who already have elevated permissions.

How could an attacker exploit this vulnerability?

An attacker with System Administrator privileges could modify specific data associated with background operations through the CRM web interface. When the system later processes this data, it may be deserialized without proper validation, allowing the attacker to trigger unauthorized commands on the CRM server.

According to the CVSS metric, successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

This vulnerability could lead to the attacker gaining the ability to interact with other tenant’s applications and content.