CVE-2025-29821: Microsoft Dynamics Business Central Information Disclosure Vulnerability

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-08 · updated 2026-08-10
Weakness: CWE-20

Description

Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.

Affected products

Microsoft Dynamics 365 Business Central 2023: from 23.1.13812 before 23.18.32409 — fixed in 23.18.32409
Microsoft Dynamics 365 Business Central 2024: before 24.12.32447; from 25.1.25900 before 25.6.32556 — fixed in 24.12.32447, 25.6.32556
Microsoft Dynamics 365 Business Central 2025: before 26.0.32481 — fixed in 26.0.32481
Microsoft Dynamics 365 Business Central 2023 Wave 2: from 23.0 before 23.0.32309 — fixed in 23.0.32309
Microsoft Dynamics 365 Business Central 2024 Wave 1 2024: from 24.0 before 24.0.32305 — fixed in 24.0.32305
Microsoft Dynamics 365 Business Central 2024 Wave 2: from 25.0 before 25.2.32308 — fixed in 25.2.32308
Microsoft Dynamics 365 Business Central 2025 Wave 1: from 26.0 before 26.0.32481 — fixed in 26.0.32481

How to fix

Upgrade to a fixed version: Microsoft Dynamics 365 Business Central 2023 23.18.32409; Microsoft Dynamics 365 Business Central 2024 24.12.32447, 25.6.32556; Microsoft Dynamics 365 Business Central 2025 26.0.32481; Microsoft Dynamics 365 Business Central 2023 Wave 2 23.0.32309; Microsoft Dynamics 365 Business Central 2024 Wave 1 2024 24.0.32305; Microsoft Dynamics 365 Business Central 2024 Wave 2 25.2.32308; Microsoft Dynamics 365 Business Central 2025 Wave 1 26.0.32481. Check the vendor advisory for mitigations.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29821

Get alerted when CVE-2025-29821 or the next vulnerability affects your stack