CVE-2020-16860: A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) when the server fails to properly sanitize web requests to an affected…

PriorityP261high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

2.69%

84.1th percentile

A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) when the server fails to properly sanitize web requests to an affected Dynamics server. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SQL service account. An authenticated attacker could exploit this vulnerability by sending a specially crafted request to a vulnerable Dynamics server. The security update addresses the vulnerability by correcting how Microsoft Dynamics 365 (on-premises) validates and sanitizes user input.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	dynamics_365	—	—
microsoft	microsoft_dynamics_365_version_9.0	>= 9.0.0 < publication	publication
msrc	microsoft_dynamics_365_version_9.0	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Vulnerability is triggered by a specially crafted web request to an on-premises Dynamics 365 server; monitor for anomalous or malformed HTTP requests targeting the Dynamics server endpoint ↗
→Successful exploitation results in code execution in the context of the SQL service account; monitor for unexpected process spawning or command execution under the SQL service account identity ↗

·Exploitation requires prior authentication; unauthenticated attackers cannot directly trigger this vulnerability ↗
·Affects only on-premises deployments of Microsoft Dynamics 365; cloud/hosted instances are not in scope ↗
·As of advisory publication, no public exploit or active exploitation in the wild was confirmed ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

vendor_msrc6.8MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.