CVE-2022-23259

Deeper analysis

Microsoft Dynamics 365 On-Premises contains a remote code execution vulnerability tracked as CVE-2022-23259. The flaw received a CVSS 3.1 score of 8.8 and affects the on-premises deployment of the Dynamics 365 application, allowing an attacker to run arbitrary code on the server.

An authenticated attacker with low privileges can exploit the issue over the network without user interaction. Successful exploitation grants full control over confidentiality, integrity, and availability on the affected system, consistent with the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Microsoft has published official guidance and patches for the vulnerability through its Security Response Center at the listed MSRC advisory URL. Administrators should apply the updates referenced in that advisory to eliminate the exposure.

The associated EPSS score reached a peak of 0.0959 and currently sits at 0.0737; the modest movement does not indicate a pronounced post-disclosure increase in exploitation interest.