Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-88131: Microsoft Dataverse lets attackers run code remotely
CVE-2026-88131 · published 2 days ago
Summary
Microsoft Dataverse can be tricked into running malicious code sent over a network. This means an attacker could take control of the system that hosts your data. Apply any available updates from Microsoft and restrict network access to Dataverse services to trusted users only.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | microsoft dataverse | - |
Original advisory text
Microsoft Dataverse Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88131 vendor-advisory patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published8 Oct 2026
Updated10 Oct 2026
First seen8 Oct 2026
Track software like this
Free during beta