TI-2026-73299 Aliases CVE-2026-102226 GHSA-xjgf-2pjj-58vp

Path traversal in Dynamics Business Central allows privilege escalation

MEDIUM 42CWE-22Published 2026-10-13 · Updated 2026-10-31

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Dynamics Business Central is affected by a path traversal flaw (CWE-22) that allows an authorized attacker to escalate privileges over a network. Microsoft Dynamics NAV 2018 is affected from 1.0 before 11.0.50736.0. An authorized attacker with low privileges can exploit the flaw remotely with low complexity and no user interaction, and the impact is high on confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01039 64th percentileScored 2026-11-07

Fix Fixed Microsoft Dynamics NAV 2018 (Microsoft): 11.0.50736.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Microsoft Dynamics NAV 2018	1.0 to before 11.0.50736.0	11.0.50736.0	Patch available	CNA

Microsoft Dynamics NAV 2018 VendorMicrosoft Affected 1.0 to before 11.0.50736.0 Fixed in 11.0.50736.0 Patch available CNA

Remediation

Update Microsoft Dynamics NAV 2018 to version 11.0.50736.0 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Microsoft Dynamics NAV 2018 (Microsoft) Fixed in 11.0.50736.0

Timeline

2026-10-13 Threatist record created from CVE-2026-102226
2026-10-13 Alias added: GHSA-xjgf-2pjj-58vp
2026-10-14 CISA SSVC decision points changed
2026-10-14 Priority changed: MEDIUM → LOW
2026-10-14 Priority changed: LOW → MEDIUM

References

Patch 1

Dynamics Business Central Elevation of Privilege Vulnerability

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences