What’s Vulnerable › Vulnerabilities

CVE-2021-34474: Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

• Severity: medium (CVSS 6.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-07-14 · updated 2026-08-10

Description

Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

Affected products

• Microsoft Dynamics 365 Business Central 2023 Release Wave 1: 2020-release_wave_1, 2020-release_wave_2, 2021-release_wave_1
• Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.14: from 16.0 before 16.0.27253 — fixed in 16.0.27253
• Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.8: from 17.0 before 17.0.27235 — fixed in 17.0.27235
• Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.3: from 18.0 before 18.0.27469 — fixed in 18.0.27469

How to fix

Upgrade to a fixed version: Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.14 16.0.27253; Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.8 17.0.27235; Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.3 18.0.27469. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34474
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34474

Get alerted when CVE-2021-34474 or the next vulnerability affects your stack