Advisory · CVE-2026-88131
Unauthenticated deserialization flaw in Microsoft Dataverse allows remote code execution
Microsoft Dataverse deserialized untrusted data without validating it, letting unauthenticated attackers execute code over the network, rated critical at CVSS 9.8.
- Vendor
- Microsoft
- Product
- Microsoft Dataverse
- Identifier / CWE
- CVE-2026-88131
CWE-502 - Action timing
- Immediate
Explain it like I’m five
Dataverse opened packages from strangers and followed the instructions inside. An attacker could mail a box whose instructions say 'take over the house'.
- 01Crafted payload
An unauthenticated attacker sends data to the Dataverse service over the network.
- 02Untrusted deserialization
Dataverse converts the attacker-controlled data into objects without validating it.
- 03Code runs
The deserialization path executes attacker code with full confidentiality, integrity, and availability impact.
What happened
Microsoft disclosed CVE-2026-88131 in Microsoft Dataverse on October 8, 2026. The service deserializes untrusted data, allowing an unauthenticated attacker to execute code over the network. It scores 9.8 on CVSS 3.1 (network, low complexity, no privileges or user interaction required, full impact on confidentiality, integrity, and availability). NVD marks the entry as exclusively a hosted-service issue, so the fix lands on Microsoft’s side.
What to do
- No customer patch exists to apply; Microsoft remediates the service.
- Inventory the business data and integrations living in your Dataverse environments; treat them as potentially exposed until Microsoft clarifies scope.
- Review audit and diagnostics logs for unusual data submissions or service activity around October 8, 2026.
- Rotate service principals, API keys, and credentials that connect into Dataverse if misuse cannot be excluded.
- Watch for a Microsoft post-incident notice with exposure details.
Management note
Dataverse sits under business apps that often hold customer and operational data, which makes unauthenticated RCE here a data-risk story, not just a platform one. The work is triage: map what lived in the service, check the logs, and be ready to rotate keys if the exposure window stays unclear.