Read the docs
TI-2021-15023 Aliases CVE-2021-36946GHSA-2fq7-f2fp-mgxx

Microsoft Dynamics Business Central Cross-site Scripting Vulnerability

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

Microsoft Dynamics Business Central Cross-site Scripting Vulnerability

Why it matters now

EPSS 0.01028 63rd percentileScored 2026-11-07
Fix Fixed Microsoft: 5 updates

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftDynamics 365 Business Central Spring 2019 Update14.0.0 to before 14.0.4754014.0.47540Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.1516.0 to before 16.0.2845716.0.28457Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.917.0 to before 17.0.2845817.0.28458Patch availableCNA
MicrosoftMicrosoft Dynamics NAV 20171.0 to before 3060130601Patch availableCNA
MicrosoftMicrosoft Dynamics NAV 20181.0 to before 4756247562Patch availableCNA
  • Dynamics 365 Business Central Spring 2019 Update VendorMicrosoft Affected 14.0.0 to before 14.0.47540 Fixed in 14.0.47540 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.15 VendorMicrosoft Affected 16.0 to before 16.0.28457 Fixed in 16.0.28457 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.9 VendorMicrosoft Affected 17.0 to before 17.0.28458 Fixed in 17.0.28458 Patch available CNA
  • Microsoft Dynamics NAV 2017 VendorMicrosoft Affected 1.0 to before 30601 Fixed in 30601 Patch available CNA
  • Microsoft Dynamics NAV 2018 VendorMicrosoft Affected 1.0 to before 47562 Fixed in 47562 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:dynamics_365_business_central:2019:spring_update:*:*:*:*:*:*2019 spring_updateVulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_1:*:*:*:*:*:*2020 release_wave_1VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_2:*:*:*:*:*:*2020 release_wave_2VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_nav:2017:*:*:*:*:*:*:*2017VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:*2018VulnerableMicrosoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2019:spring_update:*:*:*:*:*:* Versions 2019 spring_update Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_1:*:*:*:*:*:* Versions 2020 release_wave_1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_2:*:*:*:*:*:* Versions 2020 release_wave_2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_nav:2017:*:*:*:*:*:*:* Versions 2017 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:* Versions 2018 Vulnerable ·Microsoft

Remediation

Microsoft 5 updates

  • KB5005374
    Security Update
    • Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.9 17.0.28458
  • KB5005373
    Security Update
    • Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.15 16.0.28457
  • KB5005370
    Security Update
    • Dynamics 365 Business Central Spring 2019 Update 14.0.47540
Show 2 more Microsoft updates
  • KB5005369
    Security Update
    • Microsoft Dynamics NAV 2018 47562
  • KB5005368
    Security Update
    • Microsoft Dynamics NAV 2017 30601

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Spoofing
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-36946
  2. 2026-10-03 Alias added: GHSA-2fq7-f2fp-mgxx

References

Patch 2

  • TI-2020-00875 An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
  • TI-2024-25504 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-23317 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2020-00991 A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
  • TI-2024-23316 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSS 3.1HIGH 7.3
  • TI-2020-00987 Information disclosure in Microsoft Dynamics NAV 2016 CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences