Read the docs
TI-2022-19603 Aliases CVE-2022-41066GHSA-33m5-rgm6-r8x3

Microsoft Dynamics Business Central Information Disclosure Vulnerability

Priority LOW 23Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

Microsoft Dynamics Business Central Information Disclosure Vulnerability

Why it matters now

EPSS 0.01469 73rd percentileScored 2026-11-07
Fix Fixed Microsoft: 4 updates

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftDynamics 365 Business Central Spring 2019 Update14.0.0 to before 14.0.4933914.0.49339Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2021 Release Wave 219.0.0 to before 19.0.4844619.0.48446Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2022 Release Wave 120.0.0 to before 20.0.4845720.0.48457Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2022 Release Wave 221.0.0 to before 21.0.4850421.0.48504Patch availableCNA
MicrosoftMicrosoft Dynamics NAV 20181.0 to before 4934549345Patch availableCNA
  • Dynamics 365 Business Central Spring 2019 Update VendorMicrosoft Affected 14.0.0 to before 14.0.49339 Fixed in 14.0.49339 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2021 Release Wave 2 VendorMicrosoft Affected 19.0.0 to before 19.0.48446 Fixed in 19.0.48446 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2022 Release Wave 1 VendorMicrosoft Affected 20.0.0 to before 20.0.48457 Fixed in 20.0.48457 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2022 Release Wave 2 VendorMicrosoft Affected 21.0.0 to before 21.0.48504 Fixed in 21.0.48504 Patch available CNA
  • Microsoft Dynamics NAV 2018 VendorMicrosoft Affected 1.0 to before 49345 Fixed in 49345 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:dynamics_365_business_central_2019:*:*:*:*:*:*:*:*before 14.42.49347VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central_2021:*:*:*:*:*:*:*:*up to 19.18.54872VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central_2022:*:*:*:*:*:*:*:*before 20.7.48483; 21.1.48638 to before 21.1.48638VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:*2018VulnerableMicrosoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central_2019:*:*:*:*:*:*:*:* Versions before 14.42.49347 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central_2021:*:*:*:*:*:*:*:* Versions up to 19.18.54872 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central_2022:*:*:*:*:*:*:*:* Versions before 20.7.48483; 21.1.48638 to before 21.1.48638 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:* Versions 2018 Vulnerable ·Microsoft

Remediation

Microsoft 4 updates

  • KB5021003
    Security Update
    • Microsoft Dynamics 365 Business Central 2021 Release Wave 2 19.0.48446
  • KB5021002
    Security Update
    • Microsoft Dynamics 365 Business Central 2022 Release Wave 1 20.0.48457
  • KB5021001
    Security Update
    • Dynamics 365 Business Central Spring 2019 Update 14.0.49339
Show 1 more Microsoft updates
  • KB5021000
    Security Update
    • Microsoft Dynamics NAV 2018 49345

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Information Disclosure
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Microsoft Dynamics 365 Business Central 2022 Release Wave 2Fixed 21.0.48504 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41066
  2. 2026-10-03 Alias added: GHSA-33m5-rgm6-r8x3

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences