MSRC-CVE-2021-34474 — Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). Can the exploit move from Dynamics Business Central to the underlying operating system?
An attacker who successfully exploited this vulnerability could use it to pivot from the machine to the rest of the network.

Security updates
16.0.27253 — https://support.microsoft.com/en-us/help/5004717
17.0.27235 — https://support.microsoft.com/en-us/help/5004716
18.0.27469 — https://support.microsoft.com/en-us/help/5004715

Vulnerabilities 1

High 8.0

CVE-2021-34474

Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

Microsoft Microsoft Dynamics 365 Business Central 2020 Release Wave 2 – Update 17.10 Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.5 Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.15

Jul 14, 2021

Revision history

2026-08-10 #2
Updated the build numbers. This is an informational update only.
2021-07-13 #1
Information published.

References

CVE-2021-34474 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34474
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss