Microsoft Dynamics 365 SQL Injection Vulnerability

This advisory from CERT-Bund details a critical SQL injection vulnerability affecting Microsoft Dynamics 365 Customer Engagement, specifically version 1612 (9.0.2.3034). The vulnerability, rated with a CVSS Base Score of 8.8, allows authenticated remote attackers to execute arbitrary SQL commands. Successful exploitation could lead to privilege escalation or the execution of operating system commands.

Organizations using the affected version of Microsoft Dynamics 365 Customer Engagement should immediately review the mitigation strategies provided by Microsoft. While the advisory does not specify a compliance deadline, prompt patching or implementation of workarounds is crucial to prevent unauthorized access and potential data breaches. Failure to address this vulnerability could expose sensitive business data and compromise system integrity.