An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka…
Priority MEDIUM 48Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'.
Why it matters now
EPSS 0.10838 95th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft Dynamics NAV 2018 | all versions | — | No fix listed | CNA |
| Microsoft | Microsoft Dynamics NAV 2015 | all versions | — | No fix listed | CNA |
| Microsoft | Microsoft Dynamics 365 BC On Premise | all versions | — | No fix listed | CNA |
| Microsoft | Dynamics 365 Business Central 2019 Spring Update | all versions | — | No fix listed | CNA |
| Microsoft | Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) | all versions | — | No fix listed | CNA |
| Microsoft | Microsoft Dynamics NAV 2016 | all versions | — | No fix listed | CNA |
| Microsoft | Microsoft Dynamics NAV 2017 | all versions | — | No fix listed | CNA |
| Microsoft | Microsoft Dynamics NAV 2013 | all versions | — | No fix listed | CNA |
- Microsoft Dynamics NAV 2018 VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
- Microsoft Dynamics NAV 2015 VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
- Microsoft Dynamics 365 BC On Premise VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
- Dynamics 365 Business Central 2019 Spring Update VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
- Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
- Microsoft Dynamics NAV 2016 VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
- Microsoft Dynamics NAV 2017 VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
- Microsoft Dynamics NAV 2013 VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:dynamics_365_business_central:-:-:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:dynamics_365_business_central:2019:release_wave_2:*:*:*:*:*:* | 2019 release_wave_2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:dynamics_365_business_central:2019:spring_update:*:*:*:*:*:* | 2019 spring_update | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:dynamics_nav:2013:*:*:*:*:*:*:* | 2013 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:dynamics_nav:2015:*:*:*:*:*:*:* | 2015 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:dynamics_nav:2016:*:*:*:*:*:*:* | 2016 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:dynamics_nav:2017:*:*:*:*:*:*:* | 2017 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:* | 2018 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:dynamics_365_business_central:-:-:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:dynamics_365_business_central:2019:release_wave_2:*:*:*:*:*:* Versions 2019 release_wave_2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:dynamics_365_business_central:2019:spring_update:*:*:*:*:*:* Versions 2019 spring_update Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:dynamics_nav:2013:*:*:*:*:*:*:* Versions 2013 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:dynamics_nav:2015:*:*:*:*:*:*:* Versions 2015 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:dynamics_nav:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:dynamics_nav:2017:*:*:*:*:*:*:* Versions 2017 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:* Versions 2018 Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-0905
- 2026-10-03 Alias added: GHSA-3xwp-cg99-2wx2
More Microsoft Dynamics 365 Business Central vulnerabilities
- TI-2024-25504 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-23317 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
- TI-2020-00991 A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
- TI-2024-23316 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSS 3.1HIGH 7.3
- TI-2020-00987 Information disclosure in Microsoft Dynamics NAV 2016 CVSS 3.1HIGH 7.5
- TI-2021-13503 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability CVSS 3.1HIGH 8.0
Sources
- CVE-2020-0905 · CVE Program
- CVE-2020-0905 · NVD
- FIRST EPSS
- GHSA-3xwp-cg99-2wx2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences