Vulnerabilities
Microsoft Updates Fixed Version Details for CVE-2026-59113 in Dynamics 365 Server
Microsoft has corrected the remediation details for CVE-2026-59113, a remote code execution vulnerability impacting Visual Studio Code integrations within Dynamics 365 Server on-premises. SecOps and sysadmins should note that the actual patch is bundled in Dynamics 365 Server v9.1 Update 1.45 rather than version 6.2. Defenders need to verify their deployment builds against the updated advisories to ensure proper mitigation.
What Happened
Microsoft issued an informational update regarding CVE-2026-59113, clarifying the specific build and version containing the security fix. The remediation was erroneously documented as part of Dynamics 365 Server version 6.2, but has been officially corrected to Dynamics 365 Server v9.1 (on-premises) Update 1.45, corresponding to version 9.1.0045.0011.
Impact
This vulnerability involves a remote code execution risk affecting environments running vulnerable configurations of Visual Studio Code components alongside local Dynamics 365 Server installations. Organizations tracking their patch management compliance based on the initial version 6.2 advisory remain potentially exposed until updated to the correct build.
What to Do
Sysadmins and infrastructure teams managing on-premises Dynamics 365 deployments should take the following actions:
- Review current internal software inventories for affected Dynamics 365 Server instances.
- Apply Dynamics 365 Server v9.1 Update 1.45 (build 9.1.0045.0011) using the revised MSRC download links and release notes.
- Verify that the correct binary build numbers are reflected across all staging and production servers.
Related vulnerabilities
CVE-2026-96236: ASP.NET Core Denial of Service – No New Fix Required
Microsoft updated its Security Updates table to add KB article links for ASP.NET Core 11.0 and Visual Studio, but the vulnerability remains fixed in the same builds. Defenders should confirm they are running a patched version and review the KB for details.
Read briefing
Microsoft Corrects Version Details for Dynamics 365 Server Fix Linked to CVE-2026-54981
Microsoft has updated its security guidance to correct the specific build and version numbers for a vulnerability advisory originally referenced alongside the Visual Studio Code Python extension. System administrators maintaining on-premises deployments should note the revised target version: Dynamics 365 Server v9.1 Update 1.45. This update is informational only, confirming the accurate patch level required for mitigation.
Read briefing
CVE-2026-96957 .NET Security Feature Bypass – Informational Update
Microsoft updated the Security Updates table with KB links for .NET 11.0 and Visual Studio, clarifying that the fixed builds remain unchanged. Defenders should confirm they run the latest patched .NET version and keep Visual Studio updated.
Read briefing
CVE-2026-69803: Windows DHCP Server Information Disclosure
Microsoft has acknowledged CVE-2026-69803, an information disclosure flaw in the Windows DHCP Server that could allow attackers to read sensitive data. The vulnerability is currently unpatched; defenders should monitor for updates and limit DHCP exposure.
Read briefing