CVE-2022-35805

Deeper analysis

CVE-2022-35805 is a remote code execution vulnerability affecting Microsoft Dynamics CRM on-premises. It carries a CVSS 3.1 base score of 8.8 with a network attack vector, low attack complexity, and low privileges required, resulting in high impact to confidentiality, integrity, and availability.

An authenticated attacker with low privileges can exploit the flaw remotely over the network and without user interaction to achieve arbitrary code execution on the target system. The vulnerability therefore allows an adversary who already possesses valid low-privileged credentials to fully compromise the affected CRM instance.

Microsoft has published official guidance and remediation details for the issue through its Security Response Center at the referenced advisories. The EPSS probability rose from lower values to a recorded peak of 0.1179 before receding to the current score of 0.0636.