CVE-2022-21957

Deeper analysis

CVE-2022-21957 is a remote code execution vulnerability affecting Microsoft Dynamics 365 On-Premises. It carries a CVSS 3.1 base score of 7.2 with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating that successful exploitation can result in full confidentiality, integrity, and availability impact on the affected system.

An attacker with high-privileged network access and no user interaction required can exploit the flaw to execute arbitrary code on the Dynamics 365 server. The requirement for high privileges limits the pool of potential attackers to authenticated administrators or equivalent roles who already possess legitimate access to the on-premises deployment.

Microsoft Security Response Center advisories at the referenced URLs describe available patches and mitigation guidance for the vulnerability. The EPSS score remains flat at a peak and current value of 0.0615, providing no indication of rising exploitation interest after disclosure.