SQL Injection in N/a

CVE-2025-58112

Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports via raw SQL queries in an upload of a .rdl (Report Definition Language) file; this is then processed by the SQL Server Reporting Service. An account with the privilege Add Reporting Services Reports can upload a malicious rdl file. If the malicious rdl file is already loaded and it is executable by the user, the Add Reporting Services Reports privilege is not required. A malicious actor can trigger the generation of the report, causing the execution of arbitrary SQL commands in the underlying database. Depending on the permissions of the account running SQL Server Reporting Services, the attacker may be able to perform additional actions, such as accessing linked servers or executing operating system commands.

Vulnerability class: SQL Injection

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.005 (37.9th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 37.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-58112: held from 0.005 to 0.005.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2025-58112?
CVE-2025-58112 is a high-severity vulnerability in N/a, classified under SQL Injection. CVSS score: 8.8/10. Published 2026-03-18.
How severe is CVE-2025-58112?
High severity. CVSS v3 base score is 8.8 out of 10.