CVE-2025-58112
Published: 18 March 2026
Summary
CVE-2025-58112 is a high-severity SQL Injection (CWE-89) vulnerability in Microsoft Dynamics (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-58112 is a SQL injection vulnerability (CWE-89) in Microsoft Dynamics 365 Customer Engagement (on-premises) version 1612 (9.0.2.3034). The issue arises during the generation of customized reports, where raw SQL queries embedded in uploaded .rdl (Report Definition Language) files are processed by SQL Server Reporting Services. Published on 2026-03-18, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An authenticated attacker with the "Add Reporting Services Reports" privilege can upload a malicious .rdl file containing arbitrary SQL commands. If a malicious .rdl file is already loaded and executable by the user, the upload privilege is not required. Triggering the report generation executes the embedded SQL on the underlying database, potentially allowing data access, modification, or deletion. Depending on the permissions of the account running SQL Server Reporting Services, the attacker may also access linked servers or execute operating system commands.
Mitigation details and additional information are available in the referenced advisories, including https://gist.github.com/Redteam-LongwaveSpa/141f6c52ce49f9c0f49989c7d6940abd and https://microsoft.com.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208846
Vulnerability details
Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports via raw SQL queries in an upload of a .rdl (Report Definition Language) file; this is then processed by the SQL Server Reporting Service. An account…
more
with the privilege Add Reporting Services Reports can upload a malicious rdl file. If the malicious rdl file is already loaded and it is executable by the user, the Add Reporting Services Reports privilege is not required. A malicious actor can trigger the generation of the report, causing the execution of arbitrary SQL commands in the underlying database. Depending on the permissions of the account running SQL Server Reporting Services, the attacker may be able to perform additional actions, such as accessing linked servers or executing operating system commands.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in Dynamics 365 report upload/execution path directly enables remote exploitation of a network-accessible application (AV:N) for arbitrary SQL/OS command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection vulnerability by validating raw SQL queries embedded in uploaded .rdl files before processing by SQL Server Reporting Services.
Remediates the specific SQL injection flaw in Microsoft Dynamics 365 Customer Engagement version 9.0.2.3034 through timely patching or updates.
Limits damage from arbitrary SQL execution by enforcing least privilege on the SQL Server Reporting Services account, reducing permissions for linked servers or OS commands.