Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Priority LOW 36CWE-1390Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.
Summary
Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00272 19th percentileScored 2026-11-07
Fix Fixed Microsoft Dynamics 365 Business Central 2024 Release Wave 2 (Microsoft): 25.2.48119Microsoft Dynamics 365 Business Central 2026 Release Wave 1 (Microsoft): 28.0.49873+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2024 Release Wave 2 | 25.0 to before 25.2.48119 | 25.2.48119 | Patch available | CNA |
| Microsoft | Microsoft Dynamics 365 Business Central 2026 Release Wave 1 | 28.0 to before 28.0.49873 | 28.0.49873 | Patch available | CNA |
| Microsoft | Microsoft Dynamics 365 Business Central Release Wave 1 2025 | 26.0 to before 26.0.48120 | 26.0.48120 | Patch available | CNA |
| Microsoft | Microsoft Dynamics 365 Business Central Release Wave 2 2025 | 27.0 to before 27.0.48102 | 27.0.48102 | Patch available | CNA |
- Microsoft Dynamics 365 Business Central 2024 Release Wave 2 VendorMicrosoft Affected 25.0 to before 25.2.48119 Fixed in 25.2.48119 Patch available CNA
- Microsoft Dynamics 365 Business Central 2026 Release Wave 1 VendorMicrosoft Affected 28.0 to before 28.0.49873 Fixed in 28.0.49873 Patch available CNA
- Microsoft Dynamics 365 Business Central Release Wave 1 2025 VendorMicrosoft Affected 26.0 to before 26.0.48120 Fixed in 26.0.48120 Patch available CNA
- Microsoft Dynamics 365 Business Central Release Wave 2 2025 VendorMicrosoft Affected 27.0 to before 27.0.48102 Fixed in 27.0.48102 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:dynamics_365_business_central:2024:release_wave_2:*:*:*:*:*:* | 2024 release_wave_2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:dynamics_365_business_central:2025:release_wave_1:*:*:*:*:*:* | 2025 release_wave_1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:dynamics_365_business_central:2025:release_wave_2:*:*:*:*:*:* | 2025 release_wave_2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:dynamics_365_business_central:2026:release_wave_1:*:*:*:*:*:* | 2026 release_wave_1 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:dynamics_365_business_central:2024:release_wave_2:*:*:*:*:*:* Versions 2024 release_wave_2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:dynamics_365_business_central:2025:release_wave_1:*:*:*:*:*:* Versions 2025 release_wave_1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:dynamics_365_business_central:2025:release_wave_2:*:*:*:*:*:* Versions 2025 release_wave_2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:dynamics_365_business_central:2026:release_wave_1:*:*:*:*:*:* Versions 2026 release_wave_1 Vulnerable ·Microsoft
Remediation
- Fix · CNA Microsoft Dynamics 365 Business Central 2024 Release Wave 2 (Microsoft) Fixed in 25.2.48119
- Fix · CNA Microsoft Dynamics 365 Business Central 2026 Release Wave 1 (Microsoft) Fixed in 28.0.49873
- Fix · CNA Microsoft Dynamics 365 Business Central Release Wave 1 2025 (Microsoft) Fixed in 26.0.48120
- Fix · CNA Microsoft Dynamics 365 Business Central Release Wave 2 2025 (Microsoft) Fixed in 27.0.48102
Vendor assessments
Microsoft
Microsoft's page for this CVE →
- Impact
- Elevation of Privilege
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
| Product | Status | Plan or fix |
|---|---|---|
| Microsoft Dynamics 365 Business Central 2024 Release Wave 2 | Fixed | 25.2.48119 · Security Update |
| Microsoft Dynamics 365 Business Central 2026 Release Wave 1 | Fixed | 28.0.49873 · Security Update |
| Microsoft Dynamics 365 Business Central Release Wave 1 2025 | Fixed | 26.0.48120 · Security Update |
| Microsoft Dynamics 365 Business Central Release Wave 2 2025 | Fixed | 27.0.48102 · Security Update |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40417
- 2026-10-03 Alias added: GHSA-x37p-2fc6-57xh
More Microsoft Dynamics 365 Business Central vulnerabilities
- TI-2020-00875 An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
- TI-2024-25504 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2024-23317 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
- TI-2020-00991 A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
- TI-2024-23316 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSS 3.1HIGH 7.3
- TI-2020-00987 Information disclosure in Microsoft Dynamics NAV 2016 CVSS 3.1HIGH 7.5
Sources
- CVE-2026-40417 · CVE Program
- CVE-2026-40417 · NVD
- FIRST EPSS
- GHSA-x37p-2fc6-57xh · GitHub Advisory Database · CC BY 4.0
- CVE-2026-40417 · Microsoft Security Update Guide
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences