Read the docs
TI-2022-19648 Aliases CVE-2022-41127GHSA-wj3j-9c8f-9hvm

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Priority MEDIUM 40Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Why it matters now

EPSS 0.01711 77th percentileScored 2026-11-07
Fix Fixed Microsoft: 11 updates

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Dynamics NAV 20161.0 to before Build 52203Build 52203Patch availableCNA
MicrosoftMicrosoft Dynamics NAV 20171.0 to before Build 30712Build 30712Patch availableCNA
MicrosoftMicrosoft Dynamics NAV 20181.0 to before Build 49497Build 49497Patch availableCNA
MicrosoftMicrosoft Dynamics NAV 20151.0 to before 5220452204Patch availableCNA
MicrosoftDynamics 365 Business Central Spring 2019 Update14.0.0 to before App Build 14.43.49498, Platform Build 14.0.49494App Build 14.43.49498, Platform Build 14.0.49494Patch availableCNA
MicrosoftDynamics 365 Business Central 2019 Release Wave 2 (On-Premise)15.0.0 to before App Build 15.17.48428, Platform Build 15.0.48App Build 15.17.48428, Platform Build 15.0.48Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2020 Release Wave 217.0.0 to before App Build 17.17.38111, Platform Build 17.0.38061App Build 17.17.38111, Platform Build 17.0.38061Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2020 Release Wave 116.0.0 to before App Build 16.19.35126, Platform Build 16.35120App Build 16.19.35126, Platform Build 16.35120Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2022 Release Wave 120.0.0 to before App Build 20.8.49971, Platform Build 20.0.49947App Build 20.8.49971, Platform Build 20.0.49947Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2021 Release Wave 219.0.0 to before App Build 19.14.49970, Platform Build 19.0.49925App Build 19.14.49970, Platform Build 19.0.49925Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2022 Release Wave 221.0.0 to before App Build 21.2.49990, Platform Build 21.0.49984App Build 21.2.49990, Platform Build 21.0.49984Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2021 Release Wave 118.0.0 to before App Build 18.18.46920, Platform Build 18.0.46905App Build 18.18.46920, Platform Build 18.0.46905Patch availableCNA
MicrosoftMicrosoft Dynamics NAV 2013 R21.0 to before 5229752297Patch availableCNA
  • Microsoft Dynamics NAV 2016 VendorMicrosoft Affected 1.0 to before Build 52203 Fixed in Build 52203 Patch available CNA
  • Microsoft Dynamics NAV 2017 VendorMicrosoft Affected 1.0 to before Build 30712 Fixed in Build 30712 Patch available CNA
  • Microsoft Dynamics NAV 2018 VendorMicrosoft Affected 1.0 to before Build 49497 Fixed in Build 49497 Patch available CNA
  • Microsoft Dynamics NAV 2015 VendorMicrosoft Affected 1.0 to before 52204 Fixed in 52204 Patch available CNA
  • Dynamics 365 Business Central Spring 2019 Update VendorMicrosoft Affected 14.0.0 to before App Build 14.43.49498, Platform Build 14.0.49494 Fixed in App Build 14.43.49498, Platform Build 14.0.49494 Patch available CNA
  • Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) VendorMicrosoft Affected 15.0.0 to before App Build 15.17.48428, Platform Build 15.0.48 Fixed in App Build 15.17.48428, Platform Build 15.0.48 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2020 Release Wave 2 VendorMicrosoft Affected 17.0.0 to before App Build 17.17.38111, Platform Build 17.0.38061 Fixed in App Build 17.17.38111, Platform Build 17.0.38061 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2020 Release Wave 1 VendorMicrosoft Affected 16.0.0 to before App Build 16.19.35126, Platform Build 16.35120 Fixed in App Build 16.19.35126, Platform Build 16.35120 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2022 Release Wave 1 VendorMicrosoft Affected 20.0.0 to before App Build 20.8.49971, Platform Build 20.0.49947 Fixed in App Build 20.8.49971, Platform Build 20.0.49947 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2021 Release Wave 2 VendorMicrosoft Affected 19.0.0 to before App Build 19.14.49970, Platform Build 19.0.49925 Fixed in App Build 19.14.49970, Platform Build 19.0.49925 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2022 Release Wave 2 VendorMicrosoft Affected 21.0.0 to before App Build 21.2.49990, Platform Build 21.0.49984 Fixed in App Build 21.2.49990, Platform Build 21.0.49984 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2021 Release Wave 1 VendorMicrosoft Affected 18.0.0 to before App Build 18.18.46920, Platform Build 18.0.46905 Fixed in App Build 18.18.46920, Platform Build 18.0.46905 Patch available CNA
  • Microsoft Dynamics NAV 2013 R2 VendorMicrosoft Affected 1.0 to before 52297 Fixed in 52297 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:dynamics_365_business_central:2019:release_wave_2:*:*:on-premise:*:*:*2019 release_wave_2VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central:2019:spring_update:*:*:*:*:*:*2019 spring_updateVulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_1:*:*:*:*:*:*2020 release_wave_1VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_2:*:*:*:*:*:*2020 release_wave_2VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central:2021:release_wave_1:*:*:*:*:*:*2021 release_wave_1VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central:2021:release_wave_2:*:*:*:*:*:*2021 release_wave_2VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central:2022:release_wave_1:*:*:*:*:*:*2022 release_wave_1VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_nav:2016:*:*:*:*:*:*:*2016VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_nav:2017:*:*:*:*:*:*:*2017VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:*2018VulnerableMicrosoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2019:release_wave_2:*:*:on-premise:*:*:* Versions 2019 release_wave_2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2019:spring_update:*:*:*:*:*:* Versions 2019 spring_update Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_1:*:*:*:*:*:* Versions 2020 release_wave_1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_2:*:*:*:*:*:* Versions 2020 release_wave_2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2021:release_wave_1:*:*:*:*:*:* Versions 2021 release_wave_1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2021:release_wave_2:*:*:*:*:*:* Versions 2021 release_wave_2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2022:release_wave_1:*:*:*:*:*:* Versions 2022 release_wave_1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_nav:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_nav:2017:*:*:*:*:*:*:* Versions 2017 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:* Versions 2018 Vulnerable ·Microsoft

Remediation

Microsoft 11 updates

  • KB5021672
    Security Update
    • Microsoft Dynamics 365 Business Central 2022 Release Wave 2 App Build 21.2.49990, Platform Build 21.0.49984
  • KB5021671
    Security Update
    • Microsoft Dynamics 365 Business Central 2022 Release Wave 1 App Build 20.8.49971, Platform Build 20.0.49947
  • KB5021670
    Security Update
    • Microsoft Dynamics 365 Business Central 2021 Release Wave 2 App Build 19.14.49970, Platform Build 19.0.49925
Show 8 more Microsoft updates
  • KB5021669
    Security Update
    • Dynamics 365 Business Central Spring 2019 Update App Build 14.43.49498, Platform Build 14.0.49494
  • KB5021668
    Security Update
    • Microsoft Dynamics NAV 2018 Build 49497
  • KB5019239
    Security Update
    • Microsoft Dynamics 365 Business Central 2021 Release Wave 1 App Build 18.18.46920, Platform Build 18.0.46905
  • KB5013420
    Security Update
    • Microsoft Dynamics 365 Business Central 2020 Release Wave 2 App Build 17.17.38111, Platform Build 17.0.38061
  • KB5010910
    Security Update
    • Microsoft Dynamics 365 Business Central 2020 Release Wave 1 App Build 16.19.35126, Platform Build 16.35120
  • KB5010202
    Security Update
    • Microsoft Dynamics NAV 2017 Build 30712
  • KB5005293
    Security Update
    • Microsoft Dynamics NAV 2016 Build 52203
  • KB5001733
    Security Update
    • Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) App Build 15.17.48428, Platform Build 15.0.48

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Remote Code Execution
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Microsoft Dynamics NAV 2013 R2Fixed 52297 · Security Update
Microsoft Dynamics NAV 2015Fixed 52204 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41127
  2. 2026-10-03 Alias added: GHSA-wj3j-9c8f-9hvm

References

Advisory 1

  • TI-2020-00875 An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
  • TI-2024-25504 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-23317 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2020-00991 A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
  • TI-2024-23316 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSS 3.1HIGH 7.3
  • TI-2020-00987 Information disclosure in Microsoft Dynamics NAV 2016 CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences