CVE-2022-41127: Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Severity: high (CVSS 8.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-13 · updated 2026-06-17

Description

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Affected products

Microsoft Dynamics 365 Business Central 2023 Release Wave 1: 2019-release_wave_2, 2019-spring_update, 2020-release_wave_1, 2020-release_wave_2, 2021-release_wave_1, 2021-release_wave_2 (+1)
Microsoft Dynamics NAV 2018: 2016, 2017, 2018
Microsoft Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise): from 15.0.0 before App Build 15.17.48428, Platform Build 15.0.48 — fixed in App Build 15.17.48428, Platform Build 15.0.48
Microsoft Dynamics 365 Business Central Spring 2019 Update: from 14.0.0 before App Build 14.43.49498, Platform Build 14.0.49494 — fixed in App Build 14.43.49498, Platform Build 14.0.49494
Microsoft Dynamics NAV 2018: from 1.0 before Build 49497 — fixed in Build 49497
Microsoft Dynamics 365 Business Central 2020 Release Wave 1: from 16.0.0 before App Build 16.19.35126, Platform Build 16.35120 — fixed in App Build 16.19.35126, Platform Build 16.35120
Microsoft Dynamics 365 Business Central 2020 Release Wave 2: from 17.0.0 before App Build 17.17.38111, Platform Build 17.0.38061 — fixed in App Build 17.17.38111, Platform Build 17.0.38061
Microsoft Dynamics 365 Business Central 2021 Release Wave 1: from 18.0.0 before App Build 18.18.46920, Platform Build 18.0.46905 — fixed in App Build 18.18.46920, Platform Build 18.0.46905
Microsoft Dynamics 365 Business Central 2021 Release Wave 2: from 19.0.0 before App Build 19.14.49970, Platform Build 19.0.49925 — fixed in App Build 19.14.49970, Platform Build 19.0.49925
Microsoft Dynamics 365 Business Central 2022 Release Wave 1: from 20.0.0 before App Build 20.8.49971, Platform Build 20.0.49947 — fixed in App Build 20.8.49971, Platform Build 20.0.49947
Microsoft Dynamics 365 Business Central 2022 Release Wave 2: from 21.0.0 before App Build 21.2.49990, Platform Build 21.0.49984 — fixed in App Build 21.2.49990, Platform Build 21.0.49984
Microsoft Dynamics NAV 2013 R2: from 1.0 before 52297 — fixed in 52297
Microsoft Dynamics NAV 2016: from 1.0 before Build 52203 — fixed in Build 52203
Microsoft Dynamics NAV 2017: from 1.0 before Build 30712 — fixed in Build 30712

How to fix

Upgrade to a fixed version: Microsoft Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) App Build 15.17.48428, Platform Build 15.0.48; Microsoft Dynamics 365 Business Central Spring 2019 Update App Build 14.43.49498, Platform Build 14.0.49494; Microsoft Dynamics NAV 2018 Build 49497; Microsoft Dynamics 365 Business Central 2020 Release Wave 1 App Build 16.19.35126, Platform Build 16.35120; Microsoft Dynamics 365 Business Central 2020 Release Wave 2 App Build 17.17.38111, Platform Build 17.0.38061; Microsoft Dynamics 365 Business Central 2021 Release Wave 1 App Build 18.18.46920, Platform Build 18.0.46905; Microsoft Dynamics 365 Business Central 2021 Release Wave 2 App Build 19.14.49970, Platform Build 19.0.49925; Microsoft Dynamics 365 Business Central 2022 Release Wave 1 App Build 20.8.49971, Platform Build 20.0.49947; Microsoft Dynamics 365 Business Central 2022 Release Wave 2 App Build 21.2.49990, Platform Build 21.0.49984; Microsoft Dynamics NAV 2013 R2 52297; Microsoft Dynamics NAV 2016 Build 52203; Microsoft Dynamics NAV 2017 Build 30712. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-41127 or the next vulnerability affects your stack