CVE-2022-41066: Microsoft Dynamics Business Central Information Disclosure Vulnerability

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-09 · updated 2026-08-10

Description

Microsoft Dynamics Business Central Information Disclosure Vulnerability

Affected products

Microsoft Dynamics 365 Business Central 2019: before 14.42.49347 — fixed in 14.42.49347
Microsoft Dynamics 365 Business Central 2021: through 19.18.54872
Microsoft Dynamics 365 Business Central 2022: before 20.7.48483; from 21.1.48638 before 21.1.48638 — fixed in 20.7.48483, 21.1.48638
Microsoft Dynamics NAV 2018: 2018
Microsoft Dynamics 365 Business Central Spring 2019 Update: from 14.0.0 before 14.0.49339 — fixed in 14.0.49339
Microsoft Dynamics NAV 2018: from 1.0 before 49345 — fixed in 49345
Microsoft Dynamics 365 Business Central 2021 Release Wave 2: from 19.0.0 before 19.0.48446 — fixed in 19.0.48446
Microsoft Dynamics 365 Business Central 2022 Release Wave 1: from 20.0.0 before 20.0.48457 — fixed in 20.0.48457
Microsoft Dynamics 365 Business Central 2022 Release Wave 2: from 21.0.0 before 21.0.48504 — fixed in 21.0.48504

How to fix

Upgrade to a fixed version: Microsoft Dynamics 365 Business Central 2019 14.42.49347; Microsoft Dynamics 365 Business Central 2022 20.7.48483, 21.1.48638; Microsoft Dynamics 365 Business Central Spring 2019 Update 14.0.49339; Microsoft Dynamics NAV 2018 49345; Microsoft Dynamics 365 Business Central 2021 Release Wave 2 19.0.48446; Microsoft Dynamics 365 Business Central 2022 Release Wave 1 20.0.48457; Microsoft Dynamics 365 Business Central 2022 Release Wave 2 21.0.48504. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-41066 or the next vulnerability affects your stack