CVE-2026-65772 Overview
CVE-2026-65772 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Dynamics 365. An authenticated attacker can execute arbitrary code over the network by sending crafted serialized objects to a vulnerable endpoint. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide.
The flaw carries a CVSS 3.1 base score of 8.8 with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable exploitation with low complexity and low-privilege authentication. Successful exploitation compromises confidentiality, integrity, and availability of the Dynamics 365 application host.
Critical Impact
Authenticated attackers can achieve remote code execution on Microsoft Dynamics 365 servers, enabling data theft, business logic tampering, and lateral movement into connected enterprise systems.
Affected Products
- Microsoft Dynamics 365 (see the Microsoft Security Update CVE-2026-65772 advisory for the authoritative build list)
Discovery Timeline
- 2026-09-08 - CVE-2026-65772 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in the NVD database
Technical Details for CVE-2026-65772
Vulnerability Analysis
The vulnerability is an insecure deserialization flaw within Microsoft Dynamics 365. The affected code path accepts serialized data from a network-facing interface and reconstructs objects without validating type safety or the origin of the payload. During deserialization, gadget chains embedded in the crafted payload are invoked, leading to arbitrary code execution in the context of the Dynamics 365 process.
Exploitation requires an authenticated session with low privileges. Once a valid token is obtained, the attacker submits the malicious serialized blob to the vulnerable component. Because the attack traverses the network and does not require user interaction, it is well suited to opportunistic use by insiders or by external actors who have harvested Dynamics 365 credentials through phishing or credential stuffing.
Business impact extends beyond the Dynamics 365 host. Dynamics environments typically hold sales, customer, financial, and supply-chain records, and they integrate with Microsoft Entra ID, Power Platform, and downstream Line of Business (LOB) systems. Code execution on the Dynamics 365 tier provides an attacker with a foothold into these integrations.
Root Cause
The root cause is unsafe handling of serialized objects, categorized as [CWE-502] Deserialization of Untrusted Data. The vulnerable component invokes a deserializer that instantiates arbitrary types from attacker-controlled input. Without an allow-list of expected types or cryptographic validation of the serialized payload, gadget-chain classes present in the runtime can be chained to reach a code execution sink.
Attack Vector
The attack vector is network-based against the Dynamics 365 application interface. The attacker authenticates using any valid low-privilege account, then submits a crafted serialized object to the vulnerable endpoint. The server deserializes the payload and executes the embedded gadget chain, yielding code execution with the privileges of the Dynamics 365 service account.
No verified proof-of-concept exploit is publicly available at the time of publication. Refer to the Microsoft Security Update CVE-2026-65772 advisory for vendor-provided technical detail.
Detection Methods for CVE-2026-65772
Indicators of Compromise
- Unexpected child processes such as cmd.exe, powershell.exe, or w3wp.exe spawned by Dynamics 365 service accounts.
- Outbound network connections from Dynamics 365 application servers to untrusted or newly registered domains.
- Anomalous authenticated API requests containing large binary or Base64-encoded payloads to Dynamics 365 endpoints.
- New scheduled tasks, services, or persistence artifacts created under the Dynamics 365 service account context.
Detection Strategies
- Inspect HTTP request bodies to Dynamics 365 endpoints for serialized object markers and abnormally sized payloads.
- Correlate authentication events with subsequent process-creation telemetry on Dynamics 365 hosts to surface post-auth code execution.
- Alert on any process ancestry where the Dynamics 365 worker process is the parent of a shell or scripting interpreter.
Monitoring Recommendations
- Enable verbose application and IIS logging on Dynamics 365 servers and forward events to a centralized analytics platform.
- Monitor Microsoft Entra ID sign-in logs for low-privilege Dynamics 365 accounts exhibiting unusual API usage patterns.
- Baseline outbound traffic from Dynamics 365 hosts and alert on deviations, particularly to non-Microsoft destinations.
How to Mitigate CVE-2026-65772
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-65772 advisory as soon as maintenance windows permit.
- Inventory all Dynamics 365 deployments, including on-premises and hybrid instances, and confirm patch status against MSRC guidance.
- Rotate credentials and API keys used by low-privilege Dynamics 365 accounts if compromise is suspected.
- Review recent Dynamics 365 audit logs for suspicious authenticated activity preceding the patch window.
Patch Information
Microsoft has published the fix through the MSRC update guide entry for CVE-2026-65772. Administrators should consult the Microsoft Security Update CVE-2026-65772 advisory for the authoritative list of affected builds, cumulative updates, and installation instructions.
Workarounds
- Restrict network access to Dynamics 365 management endpoints using firewall rules or private connectivity where the workload permits.
- Enforce conditional access and multi-factor authentication (MFA) on all Dynamics 365 accounts to raise the cost of the required authenticated access.
- Apply least-privilege review of Dynamics 365 roles and remove unused low-privilege accounts that could be leveraged as an exploitation foothold.
# Configuration example: enforce MFA and audit low-privilege Dynamics 365 accounts via Microsoft Graph PowerShell
Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All","Policy.Read.All"
# List service principals and users with Dynamics 365 assignments
Get-MgServicePrincipal -Filter "displayName eq 'Dynamics 365'" |
ForEach-Object { Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $_.Id }
# Review recent sign-ins for anomalous Dynamics 365 API calls
Get-MgAuditLogSignIn -Filter "appDisplayName eq 'Dynamics 365'" -Top 200 |
Select-Object CreatedDateTime, UserPrincipalName, IpAddress, Status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
