Quick answers
- Is CVE-2026-77908 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77908 being exploited in the wild.
- How severe is CVE-2026-77908?
- High severity, with a CVSS score of 8.8, published 8 September 2026.
- Which products and versions are affected?
- Microsoft Dynamics 365.
- Is there a fix for CVE-2026-77908?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-77908 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-77908?
- Check whether you run Microsoft Dynamics 365. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a code injection flaw in the code generation mechanism of Microsoft Dynamics 365. An authorized attacker can exploit improper control of code generation to inject and execute arbitrary code over the network. This requires authentication and likely requires the attacker to have legitimate access to the system. Successful exploitation allows remote code execution within the Dynamics 365 environment, potentially leading to data exfiltration, lateral movement, or complete system compromise. A security update from Microsoft is available to address this vulnerability.
Affected products
- Microsoft Dynamics 365
Timeline
- 2026-09-08: disclosed