What’s Vulnerable › Vulnerabilities

CVE-2026-40417: Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-12 · updated 2026-10-26
• Weakness: CWE-1390

Description

Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.

Affected products

• Microsoft Dynamics 365 Business Central 2023 Release Wave 1: 2024-release_wave_2, 2025-release_wave_1, 2025-release_wave_2, 2026-release_wave_1
• Microsoft Dynamics 365 Business Central 2024 Release Wave 2: from 25.0 before 25.2.48119 — fixed in 25.2.48119
• Microsoft Dynamics 365 Business Central 2026 Release Wave 1: from 28.0 before 28.0.49873 — fixed in 28.0.49873
• Microsoft Dynamics 365 Business Central Release Wave 1 2025: from 26.0 before 26.0.48120 — fixed in 26.0.48120
• Microsoft Dynamics 365 Business Central Release Wave 2 2025: from 27.0 before 27.0.48102 — fixed in 27.0.48102

How to fix

Upgrade to a fixed version: Microsoft Dynamics 365 Business Central 2024 Release Wave 2 25.2.48119; Microsoft Dynamics 365 Business Central 2026 Release Wave 1 28.0.49873; Microsoft Dynamics 365 Business Central Release Wave 1 2025 26.0.48120; Microsoft Dynamics 365 Business Central Release Wave 2 2025 27.0.48102. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40417

Get alerted when CVE-2026-40417 or the next vulnerability affects your stack