Read the docs
TI-2021-17492 Aliases CVE-2021-40440GHSA-7hv9-m3f4-mcw5

Microsoft Dynamics Business Central Cross-site Scripting Vulnerability

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

Microsoft Dynamics Business Central Cross-site Scripting Vulnerability

Why it matters now

EPSS 0.01064 64th percentileScored 2026-11-07
Fix Fixed Microsoft: 2 updates

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Dynamics 365 Business Central 2020 Release Wave 2 – Update 17.1017.0.0.0 to before 17.0.2946017.0.29460Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.518.0.0.0 to before 18.0.2948618.0.29486Patch availableCNA
  • Microsoft Dynamics 365 Business Central 2020 Release Wave 2 – Update 17.10 VendorMicrosoft Affected 17.0.0.0 to before 17.0.29460 Fixed in 17.0.29460 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.5 VendorMicrosoft Affected 18.0.0.0 to before 18.0.29486 Fixed in 18.0.29486 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:dynamics_365_business_central:2020:update_17.10:release_wave_2:*:*:*:*:*2020 update_17.10VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central:2021:update_18.5:release_wave_1:*:*:*:*:*2021 update_18.5VulnerableMicrosoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2020:update_17.10:release_wave_2:*:*:*:*:* Versions 2020 update_17.10 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2021:update_18.5:release_wave_1:*:*:*:*:* Versions 2021 update_18.5 Vulnerable ·Microsoft

Remediation

Microsoft 2 updates

  • KB5006076
    Security Update
    • Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.5 18.0.29486
  • KB5006075
    Security Update
    • Microsoft Dynamics 365 Business Central 2020 Release Wave 2 – Update 17.10 17.0.29460

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Spoofing
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-40440
  2. 2026-10-03 Alias added: GHSA-7hv9-m3f4-mcw5

References

Patch 2

  • TI-2020-00875 An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
  • TI-2024-25504 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-23317 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2020-00991 A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
  • TI-2024-23316 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSS 3.1HIGH 7.3
  • TI-2020-00987 Information disclosure in Microsoft Dynamics NAV 2016 CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences