CVE-2026-65772 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Dynamics 365 (on-premises) deployments, particularly those using version 9.1, should assess exposure and apply patches.

Why it matters

CVE-2026-65772 allows an authorized attacker to execute code over a network due to deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) version 9.1. Defenders should prioritize verifying exposure and applying patches.

• Verify exposure of Microsoft Dynamics 365 (on-premises) version 9.1
• Apply patches to prevent code execution
• Monitor for suspicious activity

Technical summary

The vulnerability exists due to deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) version 9.1, allowing an authorized attacker to execute code over a network. The vulnerability is caused by insecure deserialization of untrusted data, which enables an attacker to execute code remotely. Defenders should prioritize verifying exposure of Microsoft Dynamics 365 (on-premises) version 9.1 and applying patches provided by Microsoft to prevent code execution.

Defensive priority

Defenders should prioritize verifying exposure of Microsoft Dynamics 365 (on-premises) version 9.1 and applying patches.

Recommended defensive actions

• Verify exposure of Microsoft Dynamics 365 (on-premises) version 9.1
• Apply patches provided by Microsoft
• Monitor for suspicious activity

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or impact. The vulnerability was reported to Microsoft, and patches were provided to address the issue. However, there is no information on public exploitation or specific attacks. Defenders should verify exposure and apply patches as a precautionary measure. The source item and CVE record provide additional context on the vulnerability, but further information may

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.