Search
Find a vulnerability
Search criteria
30 vulnerabilities found for dynamics_365_business_central by microsoft
CVE-2026-40417 (GCVE-0-2026-40417)
Vulnerability from nvd – Published: 2026-05-12 16:58 – Updated: 2026-08-10 15:14
VLAI
EPSS
VEX
Title
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Summary
Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 03:56 UTC
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2024 Release Wave 2 |
Affected:
25.0 , < 25.2.48119
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2026 Release Wave 1 |
Affected:
28.0 , < 28.0.49873
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central Release Wave 1 2025 |
Affected:
26.0 , < 26.0.48120
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central Release Wave 2 2025 |
Affected:
27.0 , < 27.0.48102
(custom)
|
Date Public
2026-05-12 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40417",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T03:56:28.143764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T10:11:00.219Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2024 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "25.2.48119",
"status": "affected",
"version": "25.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2026 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "28.0.49873",
"status": "affected",
"version": "28.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central Release Wave 1 2025",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "26.0.48120",
"status": "affected",
"version": "26.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central Release Wave 2 2025",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "27.0.48102",
"status": "affected",
"version": "27.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2026:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "28.0.49873",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2025:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "26.0.48120",
"versionStartIncluding": "26.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2025:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "27.0.48102",
"versionStartIncluding": "27.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "25.2.48119",
"versionStartIncluding": "25.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-05-12T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390: Weak Authentication",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:14:03.352Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40417"
}
],
"title": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-40417",
"datePublished": "2026-05-12T16:58:47.393Z",
"dateReserved": "2026-04-13T00:27:50.798Z",
"dateUpdated": "2026-08-10T15:14:03.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-43460 (GCVE-0-2024-43460)
Vulnerability from nvd – Published: 2024-09-17 18:15 – Updated: 2026-08-10 15:10 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Dynamics 365 Business Central Elevation of Privilege Vulnerability
Summary
Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-17 20:04 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Dynamics 365 Business Central Online |
Affected:
-
cpe:2.3:a:microsoft:.dynamics_365_business_central_online:*:*:*:*:*:*:*:* |
Date Public
2024-09-17 07:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-43460",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-17T20:04:56.742873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T20:08:16.033Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Dynamics 365 Business Central Online",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:.dynamics_365_business_central_online:*:*:*:*:*:*:*:*",
"versionStartIncluding": "-",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-09-17T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:10:58.585Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Dynamics 365 Business Central Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43460"
}
],
"tags": [
"exclusively-hosted-service"
],
"title": "Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-43460",
"datePublished": "2024-09-17T18:15:49.863Z",
"dateReserved": "2024-08-14T01:08:33.515Z",
"dateUpdated": "2026-08-10T15:10:58.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-38225 (GCVE-0-2024-38225)
Vulnerability from nvd – Published: 2024-09-10 16:53 – Updated: 2026-08-10 15:11
VLAI
EPSS
VEX
Title
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Summary
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 18:52 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 1 |
Affected:
22.0.0 , < 22.0.64727
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 2 |
Affected:
23.0.0 , < 24.0.22865
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2024 Release Wave 1 |
Affected:
24.0 , < 23.0.22561
(custom)
|
Date Public
2024-09-10 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-38225",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T18:52:19.327815Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-10T18:54:09.167Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "22.0.64727",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "24.0.22865",
"status": "affected",
"version": "23.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2024 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.0.22561",
"status": "affected",
"version": "24.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "22.0.64727",
"versionStartIncluding": "22.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "23.0.22561",
"versionStartIncluding": "24.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "24.0.22865",
"versionStartIncluding": "23.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-09-10T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:11:01.881Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38225"
}
],
"title": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-38225",
"datePublished": "2024-09-10T16:53:56.595Z",
"dateReserved": "2024-06-11T22:36:08.225Z",
"dateUpdated": "2026-08-10T15:11:01.881Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-35249 (GCVE-0-2024-35249)
Vulnerability from nvd – Published: 2024-06-11 17:00 – Updated: 2026-08-10 15:12
VLAI
EPSS
VEX
Title
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
Summary
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-13 00:00 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 1 |
Affected:
22.0.0 , < 22.0.64336
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 2 |
Affected:
23.0.0 , < 23.0.18933
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2024 Release Wave 1 |
Affected:
24.0 , < 24.0.19487
(custom)
|
Date Public
2024-06-11 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T03:55:48.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:07:46.945Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35249"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "22.0.64336",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.0.18933",
"status": "affected",
"version": "23.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2024 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "24.0.19487",
"status": "affected",
"version": "24.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "24.0.19487",
"versionStartIncluding": "24.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "22.0.64336",
"versionStartIncluding": "22.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "23.0.18933",
"versionStartIncluding": "23.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-06-11T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:12:32.981Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35249"
}
],
"title": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-35249",
"datePublished": "2024-06-11T17:00:06.410Z",
"dateReserved": "2024-05-14T20:14:47.410Z",
"dateUpdated": "2026-08-10T15:12:32.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-35248 (GCVE-0-2024-35248)
Vulnerability from nvd – Published: 2024-06-11 17:00 – Updated: 2026-08-10 15:12
VLAI
EPSS
VEX
Title
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Summary
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-13 00:00 UTC
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 1 |
Affected:
22.0.0 , < 23.0.18933
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 2 |
Affected:
23.0.0 , < 23.0.18933
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2024 Release Wave 1 |
Affected:
24.0 , < 24.0.19487
(custom)
|
Date Public
2024-06-11 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35248",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T03:55:47.474Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:07:46.912Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35248"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.0.18933",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.0.18933",
"status": "affected",
"version": "23.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2024 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "24.0.19487",
"status": "affected",
"version": "24.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "23.0.18933",
"versionStartIncluding": "22.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "23.0.18933",
"versionStartIncluding": "23.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "24.0.19487",
"versionStartIncluding": "24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-06-11T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390: Weak Authentication",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:12:32.429Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35248"
}
],
"title": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-35248",
"datePublished": "2024-06-11T17:00:05.663Z",
"dateReserved": "2024-05-14T20:14:47.410Z",
"dateUpdated": "2026-08-10T15:12:32.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-21380 (GCVE-0-2024-21380)
Vulnerability from nvd – Published: 2024-02-13 18:02 – Updated: 2026-08-10 17:53
VLAI
EPSS
VEX
Title
Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
Summary
Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-21 18:41 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2022 Release Wave 2 |
Affected:
21.0.0 , < 21.0.63175
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 1 |
Affected:
22.0.0 , < 22.0.63124
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 2 |
Affected:
23.0.0 , < 23.0.15712
(custom)
|
Date Public
2024-02-13 16:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:20:40.396Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21380"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T18:41:20.437790Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-29T18:01:02.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2022 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "21.0.63175",
"status": "affected",
"version": "21.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "22.0.63124",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.0.15712",
"status": "affected",
"version": "23.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2022:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "21.0.63175",
"versionStartIncluding": "21.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "22.0.63124",
"versionStartIncluding": "22.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "23.0.15712",
"versionStartIncluding": "23.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-02-13T16:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:53:07.955Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21380"
}
],
"title": "Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-21380",
"datePublished": "2024-02-13T18:02:43.563Z",
"dateReserved": "2023-12-08T22:45:20.452Z",
"dateUpdated": "2026-08-10T17:53:07.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-38167 (GCVE-0-2023-38167)
Vulnerability from nvd – Published: 2023-08-08 17:08 – Updated: 2026-08-10 15:12
VLAI
EPSS
VEX
Title
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Summary
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-26 21:53 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 1 |
Affected:
22.0.0 , < 22.0.59520
(custom)
cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_1:*:*:*:*:*:* |
Date Public
2023-08-08 14:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:30:14.217Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Dynamics Business Central Elevation Of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38167"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-38167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-26T21:53:44.256323Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-27T21:07:18.969Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "22.0.59520",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "22.0.59520",
"versionStartIncluding": "22.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2023-08-08T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:12:05.644Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38167"
}
],
"title": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2023-38167",
"datePublished": "2023-08-08T17:08:45.147Z",
"dateReserved": "2023-07-12T23:41:45.862Z",
"dateUpdated": "2026-08-10T15:12:05.644Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-41127 (GCVE-0-2022-41127)
Vulnerability from nvd – Published: 2022-12-13 00:00 – Updated: 2025-07-22 17:49
VLAI
EPSS
VEX
Title
Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
Summary
Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
Severity
CWE
- Remote Code Execution
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisory |
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics NAV 2016 |
Affected:
1.0 , < Build 52203
(custom)
|
|
| Microsoft | Microsoft Dynamics NAV 2017 |
Affected:
1.0 , < Build 30712
(custom)
|
|
| Microsoft | Microsoft Dynamics NAV 2018 |
Affected:
1.0 , < Build 49497
(custom)
|
|
| Microsoft | Microsoft Dynamics NAV 2015 |
Affected:
1.0 , < 52204
(custom)
|
|
| Microsoft | Dynamics 365 Business Central Spring 2019 Update |
Affected:
14.0.0 , < App Build 14.43.49498, Platform Build 14.0.49494
(custom)
|
|
| Microsoft | Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) |
Affected:
15.0.0 , < App Build 15.17.48428, Platform Build 15.0.48
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 2 |
Affected:
17.0.0 , < App Build 17.17.38111, Platform Build 17.0.38061
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 1 |
Affected:
16.0.0 , < App Build 16.19.35126, Platform Build 16.35120
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2022 Release Wave 1 |
Affected:
20.0.0 , < App Build 20.8.49971, Platform Build 20.0.49947
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2021 Release Wave 2 |
Affected:
19.0.0 , < App Build 19.14.49970, Platform Build 19.0.49925
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2022 Release Wave 2 |
Affected:
21.0.0 , < App Build 21.2.49990, Platform Build 21.0.49984
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2021 Release Wave 1 |
Affected:
18.0.0 , < App Build 18.18.46920, Platform Build 18.0.46905
(custom)
|
|
| Microsoft | Microsoft Dynamics NAV 2013 R2 |
Affected:
1.0 , < 52297
(custom)
|
Date Public
2022-12-13 08:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:35:49.377Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41127"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "Build 52203",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2017",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "Build 30712",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2018",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "Build 49497",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2015",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "52204",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Dynamics 365 Business Central Spring 2019 Update",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 14.43.49498, Platform Build 14.0.49494",
"status": "affected",
"version": "14.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 15.17.48428, Platform Build 15.0.48",
"status": "affected",
"version": "15.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 17.17.38111, Platform Build 17.0.38061",
"status": "affected",
"version": "17.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 16.19.35126, Platform Build 16.35120",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2022 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 20.8.49971, Platform Build 20.0.49947",
"status": "affected",
"version": "20.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2021 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 19.14.49970, Platform Build 19.0.49925",
"status": "affected",
"version": "19.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2022 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 21.2.49990, Platform Build 21.0.49984",
"status": "affected",
"version": "21.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2021 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 18.18.46920, Platform Build 18.0.46905",
"status": "affected",
"version": "18.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2013 R2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "52297",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2016:*:*:*:*:*:*:*:*",
"versionEndExcluding": "Build 52203",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2017:*:*:*:*:*:*:*:*",
"versionEndExcluding": "Build 30712",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2018:*:*:*:*:*:*:*:*",
"versionEndExcluding": "Build 49497",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2015:*:*:*:*:*:*:*:*",
"versionEndExcluding": "52204",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2019:*:spring_update:*:*:*:*:*:*",
"versionEndExcluding": "App Build 14.43.49498, Platform Build 14.0.49494",
"versionStartIncluding": "14.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2019:*:release_wave_2:*:*:on-premise:*:*:*",
"versionEndExcluding": "App Build 15.17.48428, Platform Build 15.0.48",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "App Build 17.17.38111, Platform Build 17.0.38061",
"versionStartIncluding": "17.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "App Build 16.19.35126, Platform Build 16.35120",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2022:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "App Build 20.8.49971, Platform Build 20.0.49947",
"versionStartIncluding": "20.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2021:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "App Build 19.14.49970, Platform Build 19.0.49925",
"versionStartIncluding": "19.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2022:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "App Build 21.2.49990, Platform Build 21.0.49984",
"versionStartIncluding": "21.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2021:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "App Build 18.18.46920, Platform Build 18.0.46905",
"versionStartIncluding": "18.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2013_R2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "52297",
"versionStartIncluding": "1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2022-12-13T08:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-22T17:49:27.342Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41127"
}
],
"title": "Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2022-41127",
"datePublished": "2022-12-13T00:00:00.000Z",
"dateReserved": "2022-09-19T00:00:00.000Z",
"dateUpdated": "2025-07-22T17:49:27.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-40440 (GCVE-0-2021-40440)
Vulnerability from nvd – Published: 2021-09-15 11:24 – Updated: 2026-08-10 15:11
VLAI
EPSS
VEX
Title
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Summary
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Severity
CWE
- Spoofing
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISCx_transferred |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 2 – Update 17.10 |
Affected:
17.0.0.0 , < 17.0.29460
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.5 |
Affected:
18.0.0.0 , < 18.0.29486
(custom)
|
Date Public
2021-09-14 14:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:44:10.250Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40440"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2 \u2013 Update 17.10",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "17.0.29460",
"status": "affected",
"version": "17.0.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.5",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "18.0.29486",
"status": "affected",
"version": "18.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:update_17.10:release_wave_2:*:*:*:*:*",
"versionEndExcluding": "17.0.29460",
"versionStartIncluding": "17.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2021:*:update_18.5:release_wave_1:*:*:*:*:*",
"versionEndExcluding": "18.0.29486",
"versionStartIncluding": "18.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2021-09-14T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Spoofing",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:11:10.113Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40440"
}
],
"title": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-40440",
"datePublished": "2021-09-15T11:24:25.000Z",
"dateReserved": "2021-09-02T00:00:00.000Z",
"dateUpdated": "2026-08-10T15:11:10.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-36946 (GCVE-0-2021-36946)
Vulnerability from nvd – Published: 2021-08-12 18:12 – Updated: 2026-08-10 15:10
VLAI
EPSS
VEX
Title
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Summary
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Severity
CWE
- Spoofing
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISCx_transferred |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Dynamics 365 Business Central Spring 2019 Update |
Affected:
14.0.0 , < 14.0.47540
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.15 |
Affected:
16.0 , < 16.0.28457
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.9 |
Affected:
17.0 , < 17.0.28458
(custom)
|
|
| Microsoft | Microsoft Dynamics NAV 2017 |
Affected:
1.0 , < 30601
(custom)
|
|
| Microsoft | Microsoft Dynamics NAV 2018 |
Affected:
1.0 , < 47562
(custom)
|
Date Public
2021-08-10 14:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:09:07.223Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36946"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Dynamics 365 Business Central Spring 2019 Update",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "14.0.47540",
"status": "affected",
"version": "14.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.15",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.28457",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.9",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "17.0.28458",
"status": "affected",
"version": "17.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics NAV 2017",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "30601",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics NAV 2018",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "47562",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2017:*:*:*:*:*:*:*:*",
"versionEndExcluding": "30601",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2018:*:*:*:*:*:*:*:*",
"versionEndExcluding": "47562",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2019:*:spring_update:*:*:*:*:*:*",
"versionEndExcluding": "14.0.47540",
"versionStartIncluding": "14.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "17.0.28458",
"versionStartIncluding": "17.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "16.0.28457",
"versionStartIncluding": "16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2021-08-10T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Spoofing",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:10:07.794Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36946"
}
],
"title": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-36946",
"datePublished": "2021-08-12T18:12:34.000Z",
"dateReserved": "2021-07-19T00:00:00.000Z",
"dateUpdated": "2026-08-10T15:10:07.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-34474 (GCVE-0-2021-34474)
Vulnerability from nvd – Published: 2021-07-14 17:54 – Updated: 2026-08-10 15:12
VLAI
EPSS
VEX
Title
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
Summary
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-26 19:10 UTC
CWE
- Remote Code Execution
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISCx_transferred |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.14 |
Affected:
16.0 , < 16.0.27253
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.8 |
Affected:
17.0 , < 17.0.27235
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.3 |
Affected:
18.0 , < 18.0.27469
(custom)
|
Date Public
2021-07-13 14:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:12:50.366Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34474"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-34474",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-26T19:10:15.938823Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-01T15:53:43.080Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.14",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.27253",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.8",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "17.0.27235",
"status": "affected",
"version": "17.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.3",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "18.0.27469",
"status": "affected",
"version": "18.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "16.0.27253",
"versionStartIncluding": "16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "17.0.27235",
"versionStartIncluding": "17.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2021:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "18.0.27469",
"versionStartIncluding": "18.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2021-07-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:12:07.310Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34474"
}
],
"title": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-34474",
"datePublished": "2021-07-14T17:54:04.000Z",
"dateReserved": "2021-06-09T00:00:00.000Z",
"dateUpdated": "2026-08-10T15:12:07.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-1724 (GCVE-0-2021-1724)
Vulnerability from nvd – Published: 2021-02-25 23:01 – Updated: 2024-08-03 16:18
VLAI
EPSS
VEX
Title
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Summary
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Severity
CWE
- Spoofing
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISC |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics NAV 2018 |
Affected:
1.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:* |
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 1 |
Affected:
16.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_1:*:*:*:*:*:* |
|
| Microsoft | Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) |
Affected:
15.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_365_business_central:2019:release_wave_2:*:*:on-premise:*:*:* |
|
| Microsoft | Microsoft Dynamics NAV 2017 |
Affected:
1.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_nav:2017:*:*:*:*:*:*:* |
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 2 |
Affected:
17.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_2:*:*:*:*:*:* |
|
| Microsoft | Microsoft Dynamics NAV 2015 |
Affected:
1.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_nav:2015:*:*:*:*:*:*:* |
|
| Microsoft | Microsoft Dynamics NAV 2016 |
Affected:
1.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_nav:2016:*:*:*:*:*:*:* |
Date Public
2021-02-09 08:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:18:11.567Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1724"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2018",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_1:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_365_business_central:2019:release_wave_2:*:*:on-premise:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "15.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_nav:2017:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2017",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_2:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "17.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_nav:2015:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2015",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_nav:2016:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-09T08:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Spoofing",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-29T22:33:18.208Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1724"
}
],
"title": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-1724",
"datePublished": "2021-02-25T23:01:27.000Z",
"dateReserved": "2020-12-02T00:00:00.000Z",
"dateUpdated": "2024-08-03T16:18:11.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-1022 (GCVE-0-2020-1022)
Vulnerability from nvd – Published: 2020-04-15 15:13 – Updated: 2024-08-04 06:25
VLAI
EPSS
VEX
Summary
A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'.
Severity
No CVSS data available.
CWE
- Remote Code Execution
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISC |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics NAV 2015 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics 365 BC On Premise |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2018 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2013 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2016 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2017 |
Affected:
unspecified
|
|
| Microsoft | Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) |
Affected:
unspecified
|
|
| Microsoft | Dynamics 365 Business Central 2019 Spring Update |
Affected:
unspecified
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:25:00.624Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1022"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics NAV 2015",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics 365 BC On Premise",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2018",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2013",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2016",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2017",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Dynamics 365 Business Central 2019 Spring Update",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka \u0027Dynamics Business Central Remote Code Execution Vulnerability\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-15T15:13:28.000Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1022"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2020-1022",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft Dynamics NAV 2015",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics 365 BC On Premise",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2018",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2013",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2016",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2017",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Dynamics 365 Business Central 2019 Spring Update",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka \u0027Dynamics Business Central Remote Code Execution Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1022",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1022"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2020-1022",
"datePublished": "2020-04-15T15:13:28.000Z",
"dateReserved": "2019-11-04T00:00:00.000Z",
"dateUpdated": "2024-08-04T06:25:00.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-1018 (GCVE-0-2020-1018)
Vulnerability from nvd – Published: 2020-04-15 15:13 – Updated: 2024-08-04 06:24
VLAI
EPSS
VEX
Summary
An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a masked field.The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked., aka 'Microsoft Dynamics Business Central/NAV Information Disclosure'.
Severity
No CVSS data available.
CWE
- Information Disclosure
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISC |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics NAV 2016 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2017 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2018 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2015 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics 365 BC On Premise |
Affected:
unspecified
|
|
| Microsoft | Dynamics 365 Business Central 2019 Spring Update |
Affected:
unspecified
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:24:59.546Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1018"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics NAV 2016",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2017",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2018",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2015",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics 365 BC On Premise",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Dynamics 365 Business Central 2019 Spring Update",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a masked field.The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked., aka \u0027Microsoft Dynamics Business Central/NAV Information Disclosure\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information Disclosure",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-15T15:13:26.000Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1018"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2020-1018",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft Dynamics NAV 2016",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2017",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2018",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2015",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics 365 BC On Premise",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Dynamics 365 Business Central 2019 Spring Update",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a masked field.The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked., aka \u0027Microsoft Dynamics Business Central/NAV Information Disclosure\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information Disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1018",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1018"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2020-1018",
"datePublished": "2020-04-15T15:13:27.000Z",
"dateReserved": "2019-11-04T00:00:00.000Z",
"dateUpdated": "2024-08-04T06:24:59.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-0905 (GCVE-0-2020-0905)
Vulnerability from nvd – Published: 2020-03-12 15:48 – Updated: 2024-08-04 06:18
VLAI
EPSS
VEX
Summary
An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'.
Severity
No CVSS data available.
CWE
- Remote Code Execution
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISC |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics NAV 2018 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2015 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics 365 BC On Premise |
Affected:
unspecified
|
|
| Microsoft | Dynamics 365 Business Central 2019 Spring Update |
Affected:
unspecified
|
|
| Microsoft | Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2016 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2017 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2013 |
Affected:
unspecified
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:18:03.491Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0905"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics NAV 2018",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2015",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics 365 BC On Premise",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Dynamics 365 Business Central 2019 Spring Update",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2016",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2017",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2013",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka \u0027Dynamics Business Central Remote Code Execution Vulnerability\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-12T15:48:59.000Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0905"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2020-0905",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft Dynamics NAV 2018",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2015",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics 365 BC On Premise",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Dynamics 365 Business Central 2019 Spring Update",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2016",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2017",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2013",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka \u0027Dynamics Business Central Remote Code Execution Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0905",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0905"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2020-0905",
"datePublished": "2020-03-12T15:48:59.000Z",
"dateReserved": "2019-11-04T00:00:00.000Z",
"dateUpdated": "2024-08-04T06:18:03.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-40417 (GCVE-0-2026-40417)
Vulnerability from cvelistv5 – Published: 2026-05-12 16:58 – Updated: 2026-08-10 15:14
VLAI
EPSS
VEX
Title
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Summary
Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 03:56 UTC
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2024 Release Wave 2 |
Affected:
25.0 , < 25.2.48119
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2026 Release Wave 1 |
Affected:
28.0 , < 28.0.49873
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central Release Wave 1 2025 |
Affected:
26.0 , < 26.0.48120
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central Release Wave 2 2025 |
Affected:
27.0 , < 27.0.48102
(custom)
|
Date Public
2026-05-12 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40417",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T03:56:28.143764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T10:11:00.219Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2024 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "25.2.48119",
"status": "affected",
"version": "25.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2026 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "28.0.49873",
"status": "affected",
"version": "28.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central Release Wave 1 2025",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "26.0.48120",
"status": "affected",
"version": "26.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central Release Wave 2 2025",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "27.0.48102",
"status": "affected",
"version": "27.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2026:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "28.0.49873",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2025:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "26.0.48120",
"versionStartIncluding": "26.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2025:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "27.0.48102",
"versionStartIncluding": "27.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "25.2.48119",
"versionStartIncluding": "25.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-05-12T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390: Weak Authentication",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:14:03.352Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40417"
}
],
"title": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-40417",
"datePublished": "2026-05-12T16:58:47.393Z",
"dateReserved": "2026-04-13T00:27:50.798Z",
"dateUpdated": "2026-08-10T15:14:03.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-43460 (GCVE-0-2024-43460)
Vulnerability from cvelistv5 – Published: 2024-09-17 18:15 – Updated: 2026-08-10 15:10 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Dynamics 365 Business Central Elevation of Privilege Vulnerability
Summary
Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-17 20:04 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Dynamics 365 Business Central Online |
Affected:
-
cpe:2.3:a:microsoft:.dynamics_365_business_central_online:*:*:*:*:*:*:*:* |
Date Public
2024-09-17 07:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-43460",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-17T20:04:56.742873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T20:08:16.033Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Dynamics 365 Business Central Online",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "-"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:.dynamics_365_business_central_online:*:*:*:*:*:*:*:*",
"versionStartIncluding": "-",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-09-17T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:10:58.585Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Dynamics 365 Business Central Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43460"
}
],
"tags": [
"exclusively-hosted-service"
],
"title": "Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-43460",
"datePublished": "2024-09-17T18:15:49.863Z",
"dateReserved": "2024-08-14T01:08:33.515Z",
"dateUpdated": "2026-08-10T15:10:58.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-38225 (GCVE-0-2024-38225)
Vulnerability from cvelistv5 – Published: 2024-09-10 16:53 – Updated: 2026-08-10 15:11
VLAI
EPSS
VEX
Title
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Summary
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 18:52 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 1 |
Affected:
22.0.0 , < 22.0.64727
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 2 |
Affected:
23.0.0 , < 24.0.22865
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2024 Release Wave 1 |
Affected:
24.0 , < 23.0.22561
(custom)
|
Date Public
2024-09-10 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-38225",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T18:52:19.327815Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-10T18:54:09.167Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "22.0.64727",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "24.0.22865",
"status": "affected",
"version": "23.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2024 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.0.22561",
"status": "affected",
"version": "24.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "22.0.64727",
"versionStartIncluding": "22.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "23.0.22561",
"versionStartIncluding": "24.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "24.0.22865",
"versionStartIncluding": "23.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-09-10T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:11:01.881Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38225"
}
],
"title": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-38225",
"datePublished": "2024-09-10T16:53:56.595Z",
"dateReserved": "2024-06-11T22:36:08.225Z",
"dateUpdated": "2026-08-10T15:11:01.881Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-35249 (GCVE-0-2024-35249)
Vulnerability from cvelistv5 – Published: 2024-06-11 17:00 – Updated: 2026-08-10 15:12
VLAI
EPSS
VEX
Title
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
Summary
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-13 00:00 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 1 |
Affected:
22.0.0 , < 22.0.64336
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 2 |
Affected:
23.0.0 , < 23.0.18933
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2024 Release Wave 1 |
Affected:
24.0 , < 24.0.19487
(custom)
|
Date Public
2024-06-11 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T03:55:48.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:07:46.945Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35249"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "22.0.64336",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.0.18933",
"status": "affected",
"version": "23.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2024 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "24.0.19487",
"status": "affected",
"version": "24.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "24.0.19487",
"versionStartIncluding": "24.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "22.0.64336",
"versionStartIncluding": "22.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "23.0.18933",
"versionStartIncluding": "23.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-06-11T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:12:32.981Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35249"
}
],
"title": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-35249",
"datePublished": "2024-06-11T17:00:06.410Z",
"dateReserved": "2024-05-14T20:14:47.410Z",
"dateUpdated": "2026-08-10T15:12:32.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-35248 (GCVE-0-2024-35248)
Vulnerability from cvelistv5 – Published: 2024-06-11 17:00 – Updated: 2026-08-10 15:12
VLAI
EPSS
VEX
Title
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Summary
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-13 00:00 UTC
CWE
- CWE-1390 - Weak Authentication
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 1 |
Affected:
22.0.0 , < 23.0.18933
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 2 |
Affected:
23.0.0 , < 23.0.18933
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2024 Release Wave 1 |
Affected:
24.0 , < 24.0.19487
(custom)
|
Date Public
2024-06-11 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35248",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T03:55:47.474Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:07:46.912Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35248"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.0.18933",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.0.18933",
"status": "affected",
"version": "23.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2024 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "24.0.19487",
"status": "affected",
"version": "24.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "23.0.18933",
"versionStartIncluding": "22.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "23.0.18933",
"versionStartIncluding": "23.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "24.0.19487",
"versionStartIncluding": "24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-06-11T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390: Weak Authentication",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:12:32.429Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35248"
}
],
"title": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-35248",
"datePublished": "2024-06-11T17:00:05.663Z",
"dateReserved": "2024-05-14T20:14:47.410Z",
"dateUpdated": "2026-08-10T15:12:32.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-21380 (GCVE-0-2024-21380)
Vulnerability from cvelistv5 – Published: 2024-02-13 18:02 – Updated: 2026-08-10 17:53
VLAI
EPSS
VEX
Title
Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
Summary
Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-21 18:41 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2022 Release Wave 2 |
Affected:
21.0.0 , < 21.0.63175
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 1 |
Affected:
22.0.0 , < 22.0.63124
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 2 |
Affected:
23.0.0 , < 23.0.15712
(custom)
|
Date Public
2024-02-13 16:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:20:40.396Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21380"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T18:41:20.437790Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-29T18:01:02.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2022 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "21.0.63175",
"status": "affected",
"version": "21.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "22.0.63124",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "23.0.15712",
"status": "affected",
"version": "23.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2022:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "21.0.63175",
"versionStartIncluding": "21.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "22.0.63124",
"versionStartIncluding": "22.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "23.0.15712",
"versionStartIncluding": "23.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-02-13T16:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:53:07.955Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21380"
}
],
"title": "Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-21380",
"datePublished": "2024-02-13T18:02:43.563Z",
"dateReserved": "2023-12-08T22:45:20.452Z",
"dateUpdated": "2026-08-10T17:53:07.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-38167 (GCVE-0-2023-38167)
Vulnerability from cvelistv5 – Published: 2023-08-08 17:08 – Updated: 2026-08-10 15:12
VLAI
EPSS
VEX
Title
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Summary
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-26 21:53 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2023 Release Wave 1 |
Affected:
22.0.0 , < 22.0.59520
(custom)
cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_1:*:*:*:*:*:* |
Date Public
2023-08-08 14:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:30:14.217Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Dynamics Business Central Elevation Of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38167"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-38167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-26T21:53:44.256323Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-27T21:07:18.969Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "22.0.59520",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "22.0.59520",
"versionStartIncluding": "22.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2023-08-08T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:12:05.644Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38167"
}
],
"title": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2023-38167",
"datePublished": "2023-08-08T17:08:45.147Z",
"dateReserved": "2023-07-12T23:41:45.862Z",
"dateUpdated": "2026-08-10T15:12:05.644Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-41127 (GCVE-0-2022-41127)
Vulnerability from cvelistv5 – Published: 2022-12-13 00:00 – Updated: 2025-07-22 17:49
VLAI
EPSS
VEX
Title
Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
Summary
Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
Severity
CWE
- Remote Code Execution
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisory |
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics NAV 2016 |
Affected:
1.0 , < Build 52203
(custom)
|
|
| Microsoft | Microsoft Dynamics NAV 2017 |
Affected:
1.0 , < Build 30712
(custom)
|
|
| Microsoft | Microsoft Dynamics NAV 2018 |
Affected:
1.0 , < Build 49497
(custom)
|
|
| Microsoft | Microsoft Dynamics NAV 2015 |
Affected:
1.0 , < 52204
(custom)
|
|
| Microsoft | Dynamics 365 Business Central Spring 2019 Update |
Affected:
14.0.0 , < App Build 14.43.49498, Platform Build 14.0.49494
(custom)
|
|
| Microsoft | Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) |
Affected:
15.0.0 , < App Build 15.17.48428, Platform Build 15.0.48
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 2 |
Affected:
17.0.0 , < App Build 17.17.38111, Platform Build 17.0.38061
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 1 |
Affected:
16.0.0 , < App Build 16.19.35126, Platform Build 16.35120
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2022 Release Wave 1 |
Affected:
20.0.0 , < App Build 20.8.49971, Platform Build 20.0.49947
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2021 Release Wave 2 |
Affected:
19.0.0 , < App Build 19.14.49970, Platform Build 19.0.49925
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2022 Release Wave 2 |
Affected:
21.0.0 , < App Build 21.2.49990, Platform Build 21.0.49984
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2021 Release Wave 1 |
Affected:
18.0.0 , < App Build 18.18.46920, Platform Build 18.0.46905
(custom)
|
|
| Microsoft | Microsoft Dynamics NAV 2013 R2 |
Affected:
1.0 , < 52297
(custom)
|
Date Public
2022-12-13 08:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:35:49.377Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41127"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "Build 52203",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2017",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "Build 30712",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2018",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "Build 49497",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2015",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "52204",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Dynamics 365 Business Central Spring 2019 Update",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 14.43.49498, Platform Build 14.0.49494",
"status": "affected",
"version": "14.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 15.17.48428, Platform Build 15.0.48",
"status": "affected",
"version": "15.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 17.17.38111, Platform Build 17.0.38061",
"status": "affected",
"version": "17.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 16.19.35126, Platform Build 16.35120",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2022 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 20.8.49971, Platform Build 20.0.49947",
"status": "affected",
"version": "20.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2021 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 19.14.49970, Platform Build 19.0.49925",
"status": "affected",
"version": "19.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2022 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 21.2.49990, Platform Build 21.0.49984",
"status": "affected",
"version": "21.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2021 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "App Build 18.18.46920, Platform Build 18.0.46905",
"status": "affected",
"version": "18.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2013 R2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "52297",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2016:*:*:*:*:*:*:*:*",
"versionEndExcluding": "Build 52203",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2017:*:*:*:*:*:*:*:*",
"versionEndExcluding": "Build 30712",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2018:*:*:*:*:*:*:*:*",
"versionEndExcluding": "Build 49497",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2015:*:*:*:*:*:*:*:*",
"versionEndExcluding": "52204",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2019:*:spring_update:*:*:*:*:*:*",
"versionEndExcluding": "App Build 14.43.49498, Platform Build 14.0.49494",
"versionStartIncluding": "14.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2019:*:release_wave_2:*:*:on-premise:*:*:*",
"versionEndExcluding": "App Build 15.17.48428, Platform Build 15.0.48",
"versionStartIncluding": "15.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "App Build 17.17.38111, Platform Build 17.0.38061",
"versionStartIncluding": "17.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "App Build 16.19.35126, Platform Build 16.35120",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2022:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "App Build 20.8.49971, Platform Build 20.0.49947",
"versionStartIncluding": "20.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2021:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "App Build 19.14.49970, Platform Build 19.0.49925",
"versionStartIncluding": "19.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2022:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "App Build 21.2.49990, Platform Build 21.0.49984",
"versionStartIncluding": "21.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2021:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "App Build 18.18.46920, Platform Build 18.0.46905",
"versionStartIncluding": "18.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2013_R2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "52297",
"versionStartIncluding": "1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2022-12-13T08:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-22T17:49:27.342Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41127"
}
],
"title": "Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2022-41127",
"datePublished": "2022-12-13T00:00:00.000Z",
"dateReserved": "2022-09-19T00:00:00.000Z",
"dateUpdated": "2025-07-22T17:49:27.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-40440 (GCVE-0-2021-40440)
Vulnerability from cvelistv5 – Published: 2021-09-15 11:24 – Updated: 2026-08-10 15:11
VLAI
EPSS
VEX
Title
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Summary
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Severity
CWE
- Spoofing
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISCx_transferred |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 2 – Update 17.10 |
Affected:
17.0.0.0 , < 17.0.29460
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.5 |
Affected:
18.0.0.0 , < 18.0.29486
(custom)
|
Date Public
2021-09-14 14:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:44:10.250Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40440"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2 \u2013 Update 17.10",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "17.0.29460",
"status": "affected",
"version": "17.0.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.5",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "18.0.29486",
"status": "affected",
"version": "18.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:update_17.10:release_wave_2:*:*:*:*:*",
"versionEndExcluding": "17.0.29460",
"versionStartIncluding": "17.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2021:*:update_18.5:release_wave_1:*:*:*:*:*",
"versionEndExcluding": "18.0.29486",
"versionStartIncluding": "18.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2021-09-14T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Spoofing",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:11:10.113Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40440"
}
],
"title": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-40440",
"datePublished": "2021-09-15T11:24:25.000Z",
"dateReserved": "2021-09-02T00:00:00.000Z",
"dateUpdated": "2026-08-10T15:11:10.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-36946 (GCVE-0-2021-36946)
Vulnerability from cvelistv5 – Published: 2021-08-12 18:12 – Updated: 2026-08-10 15:10
VLAI
EPSS
VEX
Title
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Summary
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Severity
CWE
- Spoofing
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISCx_transferred |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Dynamics 365 Business Central Spring 2019 Update |
Affected:
14.0.0 , < 14.0.47540
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.15 |
Affected:
16.0 , < 16.0.28457
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.9 |
Affected:
17.0 , < 17.0.28458
(custom)
|
|
| Microsoft | Microsoft Dynamics NAV 2017 |
Affected:
1.0 , < 30601
(custom)
|
|
| Microsoft | Microsoft Dynamics NAV 2018 |
Affected:
1.0 , < 47562
(custom)
|
Date Public
2021-08-10 14:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:09:07.223Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36946"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Dynamics 365 Business Central Spring 2019 Update",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "14.0.47540",
"status": "affected",
"version": "14.0.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.15",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.28457",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.9",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "17.0.28458",
"status": "affected",
"version": "17.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics NAV 2017",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "30601",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics NAV 2018",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "47562",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2017:*:*:*:*:*:*:*:*",
"versionEndExcluding": "30601",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_nav_2018:*:*:*:*:*:*:*:*",
"versionEndExcluding": "47562",
"versionStartIncluding": "1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2019:*:spring_update:*:*:*:*:*:*",
"versionEndExcluding": "14.0.47540",
"versionStartIncluding": "14.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "17.0.28458",
"versionStartIncluding": "17.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "16.0.28457",
"versionStartIncluding": "16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2021-08-10T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Spoofing",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:10:07.794Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36946"
}
],
"title": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-36946",
"datePublished": "2021-08-12T18:12:34.000Z",
"dateReserved": "2021-07-19T00:00:00.000Z",
"dateUpdated": "2026-08-10T15:10:07.794Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-34474 (GCVE-0-2021-34474)
Vulnerability from cvelistv5 – Published: 2021-07-14 17:54 – Updated: 2026-08-10 15:12
VLAI
EPSS
VEX
Title
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
Summary
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-26 19:10 UTC
CWE
- Remote Code Execution
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISCx_transferred |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.14 |
Affected:
16.0 , < 16.0.27253
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.8 |
Affected:
17.0 , < 17.0.27235
(custom)
|
|
| Microsoft | Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.3 |
Affected:
18.0 , < 18.0.27469
(custom)
|
Date Public
2021-07-13 14:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:12:50.366Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34474"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-34474",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-26T19:10:15.938823Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-01T15:53:43.080Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.14",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "16.0.27253",
"status": "affected",
"version": "16.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.8",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "17.0.27235",
"status": "affected",
"version": "17.0",
"versionType": "custom"
}
]
},
{
"product": "Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.3",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "18.0.27469",
"status": "affected",
"version": "18.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "16.0.27253",
"versionStartIncluding": "16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:release_wave_2:*:*:*:*:*:*",
"versionEndExcluding": "17.0.27235",
"versionStartIncluding": "17.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2021:*:release_wave_1:*:*:*:*:*:*",
"versionEndExcluding": "18.0.27469",
"versionStartIncluding": "18.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2021-07-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:12:07.310Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34474"
}
],
"title": "Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-34474",
"datePublished": "2021-07-14T17:54:04.000Z",
"dateReserved": "2021-06-09T00:00:00.000Z",
"dateUpdated": "2026-08-10T15:12:07.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-1724 (GCVE-0-2021-1724)
Vulnerability from cvelistv5 – Published: 2021-02-25 23:01 – Updated: 2024-08-03 16:18
VLAI
EPSS
VEX
Title
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Summary
Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
Severity
CWE
- Spoofing
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISC |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics NAV 2018 |
Affected:
1.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:* |
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 1 |
Affected:
16.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_1:*:*:*:*:*:* |
|
| Microsoft | Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) |
Affected:
15.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_365_business_central:2019:release_wave_2:*:*:on-premise:*:*:* |
|
| Microsoft | Microsoft Dynamics NAV 2017 |
Affected:
1.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_nav:2017:*:*:*:*:*:*:* |
|
| Microsoft | Microsoft Dynamics 365 Business Central 2020 Release Wave 2 |
Affected:
17.0.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_2:*:*:*:*:*:* |
|
| Microsoft | Microsoft Dynamics NAV 2015 |
Affected:
1.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_nav:2015:*:*:*:*:*:*:* |
|
| Microsoft | Microsoft Dynamics NAV 2016 |
Affected:
1.0 , < publication
(custom)
cpe:2.3:a:microsoft:dynamics_nav:2016:*:*:*:*:*:*:* |
Date Public
2021-02-09 08:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T16:18:11.567Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1724"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_nav:2018:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2018",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_1:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "16.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_365_business_central:2019:release_wave_2:*:*:on-premise:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "15.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_nav:2017:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2017",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_365_business_central:2020:release_wave_2:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "17.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_nav:2015:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2015",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:microsoft:dynamics_nav:2016:*:*:*:*:*:*:*"
],
"platforms": [
"Unknown"
],
"product": "Microsoft Dynamics NAV 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "publication",
"status": "affected",
"version": "1.0",
"versionType": "custom"
}
]
}
],
"datePublic": "2021-02-09T08:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Spoofing",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-29T22:33:18.208Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1724"
}
],
"title": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2021-1724",
"datePublished": "2021-02-25T23:01:27.000Z",
"dateReserved": "2020-12-02T00:00:00.000Z",
"dateUpdated": "2024-08-03T16:18:11.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-1022 (GCVE-0-2020-1022)
Vulnerability from cvelistv5 – Published: 2020-04-15 15:13 – Updated: 2024-08-04 06:25
VLAI
EPSS
VEX
Summary
A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'.
Severity
No CVSS data available.
CWE
- Remote Code Execution
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISC |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics NAV 2015 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics 365 BC On Premise |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2018 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2013 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2016 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2017 |
Affected:
unspecified
|
|
| Microsoft | Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) |
Affected:
unspecified
|
|
| Microsoft | Dynamics 365 Business Central 2019 Spring Update |
Affected:
unspecified
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:25:00.624Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1022"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics NAV 2015",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics 365 BC On Premise",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2018",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2013",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2016",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2017",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Dynamics 365 Business Central 2019 Spring Update",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka \u0027Dynamics Business Central Remote Code Execution Vulnerability\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-15T15:13:28.000Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1022"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2020-1022",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft Dynamics NAV 2015",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics 365 BC On Premise",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2018",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2013",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2016",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2017",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Dynamics 365 Business Central 2019 Spring Update",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka \u0027Dynamics Business Central Remote Code Execution Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1022",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1022"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2020-1022",
"datePublished": "2020-04-15T15:13:28.000Z",
"dateReserved": "2019-11-04T00:00:00.000Z",
"dateUpdated": "2024-08-04T06:25:00.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-1018 (GCVE-0-2020-1018)
Vulnerability from cvelistv5 – Published: 2020-04-15 15:13 – Updated: 2024-08-04 06:24
VLAI
EPSS
VEX
Summary
An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a masked field.The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked., aka 'Microsoft Dynamics Business Central/NAV Information Disclosure'.
Severity
No CVSS data available.
CWE
- Information Disclosure
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISC |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics NAV 2016 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2017 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2018 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2015 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics 365 BC On Premise |
Affected:
unspecified
|
|
| Microsoft | Dynamics 365 Business Central 2019 Spring Update |
Affected:
unspecified
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:24:59.546Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1018"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics NAV 2016",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2017",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2018",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2015",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics 365 BC On Premise",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Dynamics 365 Business Central 2019 Spring Update",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a masked field.The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked., aka \u0027Microsoft Dynamics Business Central/NAV Information Disclosure\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information Disclosure",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-15T15:13:26.000Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1018"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2020-1018",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft Dynamics NAV 2016",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2017",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2018",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2015",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics 365 BC On Premise",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Dynamics 365 Business Central 2019 Spring Update",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a masked field.The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked., aka \u0027Microsoft Dynamics Business Central/NAV Information Disclosure\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information Disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1018",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1018"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2020-1018",
"datePublished": "2020-04-15T15:13:27.000Z",
"dateReserved": "2019-11-04T00:00:00.000Z",
"dateUpdated": "2024-08-04T06:24:59.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-0905 (GCVE-0-2020-0905)
Vulnerability from cvelistv5 – Published: 2020-03-12 15:48 – Updated: 2024-08-04 06:18
VLAI
EPSS
VEX
Summary
An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'.
Severity
No CVSS data available.
CWE
- Remote Code Execution
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-… | x_refsource_MISC |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Microsoft Dynamics NAV 2018 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2015 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics 365 BC On Premise |
Affected:
unspecified
|
|
| Microsoft | Dynamics 365 Business Central 2019 Spring Update |
Affected:
unspecified
|
|
| Microsoft | Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2016 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2017 |
Affected:
unspecified
|
|
| Microsoft | Microsoft Dynamics NAV 2013 |
Affected:
unspecified
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T06:18:03.491Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0905"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Microsoft Dynamics NAV 2018",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2015",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics 365 BC On Premise",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Dynamics 365 Business Central 2019 Spring Update",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2016",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2017",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
},
{
"product": "Microsoft Dynamics NAV 2013",
"vendor": "Microsoft",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka \u0027Dynamics Business Central Remote Code Execution Vulnerability\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-12T15:48:59.000Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0905"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2020-0905",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft Dynamics NAV 2018",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2015",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics 365 BC On Premise",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Dynamics 365 Business Central 2019 Spring Update",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2016",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2017",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
},
{
"product_name": "Microsoft Dynamics NAV 2013",
"version": {
"version_data": [
{
"version_value": ""
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka \u0027Dynamics Business Central Remote Code Execution Vulnerability\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0905",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0905"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2020-0905",
"datePublished": "2020-03-12T15:48:59.000Z",
"dateReserved": "2019-11-04T00:00:00.000Z",
"dateUpdated": "2024-08-04T06:18:03.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}