Read the docs
TI-2025-21228 Aliases CVE-2025-29821GHSA-386h-wcf4-977x

Microsoft Dynamics Business Central Information Disclosure Vulnerability

Priority LOW 26CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00706 53rd percentileScored 2026-11-07
Fix Fixed Microsoft: 3 updates

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Dynamics 365 Business Central 2023 Wave 223.0 to before 23.0.3230923.0.32309Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2024 Wave 1 202424.0 to before 24.0.3230524.0.32305Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2024 Wave 225.0 to before 25.2.3230825.2.32308Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2025 Wave 126.0 to before 26.0.3248126.0.32481Patch availableCNA
  • Microsoft Dynamics 365 Business Central 2023 Wave 2 VendorMicrosoft Affected 23.0 to before 23.0.32309 Fixed in 23.0.32309 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2024 Wave 1 2024 VendorMicrosoft Affected 24.0 to before 24.0.32305 Fixed in 24.0.32305 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2024 Wave 2 VendorMicrosoft Affected 25.0 to before 25.2.32308 Fixed in 25.2.32308 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2025 Wave 1 VendorMicrosoft Affected 26.0 to before 26.0.32481 Fixed in 26.0.32481 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:*:*:*:on-premise:*:*:*23.1.13812 to before 23.18.32409VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central_2024:*:*:*:*:on-premise:*:*:*before 24.12.32447; 25.1.25900 to before 25.6.32556VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central_2025:*:*:*:*:on-premise:*:*:*before 26.0.32481VulnerableMicrosoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:*:*:*:on-premise:*:*:* Versions 23.1.13812 to before 23.18.32409 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central_2024:*:*:*:*:on-premise:*:*:* Versions before 24.12.32447; 25.1.25900 to before 25.6.32556 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central_2025:*:*:*:*:on-premise:*:*:* Versions before 26.0.32481 Vulnerable ·Microsoft

Remediation

Microsoft 3 updates

  • KB5056718
    Security Update
    • Microsoft Dynamics 365 Business Central 2024 Wave 2 – Update 25.6 25.2.32308
  • KB5056717
    Security Update
    • Microsoft Dynamics 365 Business Central Wave 1 2024 – Update 24.12 24.0.32305
  • KB5056716
    Security Update
    • Microsoft Dynamics 365 Business Central 2023 Wave 2 – Update 23.18 23.0.32309

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Information Disclosure
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Microsoft Dynamics 365 Business Central 2025 Wave 1 – Update 26.0Fixed 26.0.32481 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-29821
  2. 2026-10-03 Alias added: GHSA-386h-wcf4-977x

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences