TI-2026-73381 Aliases CVE-2026-105727 GHSA-9cfg-cm5f-fjpx

Path traversal in Dynamics NAV 2018 allows privilege elevation

MEDIUM 42CWE-22Published 2026-10-13 · Updated 2026-10-31

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Microsoft Dynamics NAV 2018 from 1.0 before 11.0.50736.0 is affected. Improper limitation of a pathname to a restricted directory (CWE-22) lets an authorized attacker on the network gain higher privileges. The attacker needs low privileges and no user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01039 64th percentileScored 2026-11-07

Fix Fixed Microsoft Dynamics NAV 2018 (Microsoft): 11.0.50736.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Microsoft Dynamics NAV 2018	1.0 to before 11.0.50736.0	11.0.50736.0	Patch available	CNA

Microsoft Dynamics NAV 2018 VendorMicrosoft Affected 1.0 to before 11.0.50736.0 Fixed in 11.0.50736.0 Patch available CNA

Remediation

Update Microsoft Dynamics NAV 2018 to version 11.0.50736.0 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Microsoft Dynamics NAV 2018 (Microsoft) Fixed in 11.0.50736.0

Timeline

2026-10-13 Threatist record created from CVE-2026-105727
2026-10-13 CISA SSVC decision points changed
2026-10-13 Priority changed: MEDIUM → LOW
2026-10-13 Alias added: GHSA-9cfg-cm5f-fjpx
2026-10-14 Priority changed: LOW → MEDIUM

References

Patch 1

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences