CVE-2026-65815 Overview
CVE-2026-65815 is a deserialization of untrusted data vulnerability [CWE-502] in Microsoft Dynamics 365 (on-premises). An authenticated attacker with low privileges can send crafted serialized payloads over the network to execute arbitrary code on the target server. Successful exploitation compromises confidentiality, integrity, and availability of the Dynamics 365 environment. Because Dynamics 365 servers often store customer, financial, and operational records, code execution on these hosts can pivot into broader business systems. Microsoft published the advisory in its Security Update Guide.
Critical Impact
An authorized attacker can achieve remote code execution on Microsoft Dynamics 365 (on-premises) servers by sending crafted serialized objects, resulting in full compromise of the affected instance.
Affected Products
- Microsoft Dynamics 365 (on-premises)
Discovery Timeline
- 2026-08-11 - CVE-2026-65815 published to the National Vulnerability Database
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-65815
Vulnerability Analysis
The vulnerability stems from unsafe deserialization of attacker-controlled data within Microsoft Dynamics 365 (on-premises). When the application processes a serialized object supplied over the network, it reconstructs .NET types without sufficient validation of the incoming stream. An authenticated user can craft a payload that instantiates gadget chains during deserialization, leading to arbitrary code execution in the context of the Dynamics 365 service account. The flaw is categorized under [CWE-502] Deserialization of Untrusted Data. Exploitation requires network access to a Dynamics 365 endpoint and valid low-privilege credentials, but no user interaction. The EPSS probability sits at 0.909%, indicating measurable interest in weaponization.
Root Cause
The root cause is the use of an insecure deserializer that binds serialized input to arbitrary .NET types without a strict type allowlist. Dangerous surrogate classes such as those in the System.Workflow, System.Data, or ObjectDataProvider families can be leveraged as deserialization gadgets. When these gadgets are reconstructed, they invoke methods that execute code embedded in the payload.
Attack Vector
The attack vector is network-based and requires authentication. An attacker with an authenticated session sends a crafted HTTP request containing a malicious serialized object to a Dynamics 365 endpoint that accepts such input. The server deserializes the object, triggering gadget-chain execution and running commands under the Dynamics 365 application identity. No user interaction is required to complete exploitation. See the Microsoft Security Update Guide for further technical detail.
Detection Methods for CVE-2026-65815
Indicators of Compromise
- Unexpected child processes spawned by Dynamics 365 worker processes such as w3wp.exe or CrmAsyncService.exe, particularly cmd.exe, powershell.exe, or rundll32.exe.
- HTTP POST requests to Dynamics 365 endpoints containing Base64-encoded serialized .NET payloads or BinaryFormatter markers.
- Outbound network connections initiated by Dynamics 365 service accounts to previously unseen external hosts.
- New scheduled tasks, services, or WMI subscriptions created on Dynamics 365 servers shortly after suspicious authenticated sessions.
Detection Strategies
- Inspect IIS and Dynamics 365 application logs for anomalous request bodies to endpoints that accept serialized data, correlating with the authenticating user identity.
- Hunt for process lineage anomalies where Dynamics 365 service processes launch scripting or system-management binaries.
- Alert on deserialization exceptions and stack traces referencing BinaryFormatter, NetDataContractSerializer, or SoapFormatter in application event logs.
Monitoring Recommendations
- Forward IIS, Windows Security, and Dynamics 365 application logs to a centralized analytics platform for correlation across authentication and process events.
- Baseline normal Dynamics 365 service account behavior and alert on deviations in outbound network destinations and process creation.
- Monitor authentication activity for low-privilege Dynamics 365 accounts exhibiting sudden administrative or exploration behavior.
How to Mitigate CVE-2026-65815
Immediate Actions Required
- Apply the security update referenced in the Microsoft Security Update Guide to all Dynamics 365 (on-premises) servers.
- Inventory all Dynamics 365 (on-premises) deployments, including test and staging environments, to ensure comprehensive patch coverage.
- Review recent authentication logs for suspicious low-privilege account activity that could indicate pre-patch exploitation.
- Rotate credentials and service account secrets on any server suspected of exposure prior to patching.
Patch Information
Microsoft has published a security update for CVE-2026-65815 through the Microsoft Security Update Guide. Administrators should reference the Microsoft Security Update Guide entry for CVE-2026-65815 for the specific KB articles and build numbers applicable to their Dynamics 365 (on-premises) version.
Workarounds
- Restrict network access to Dynamics 365 (on-premises) endpoints so that only trusted, authenticated corporate networks or VPN clients can reach the application.
- Enforce least privilege on Dynamics 365 user accounts and remove access for identities that do not require it.
- Enable multi-factor authentication for all Dynamics 365 users to raise the cost of obtaining the authenticated foothold required for exploitation.
- Run the Dynamics 365 application pool under a low-privilege service account to limit blast radius if code execution occurs.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
