Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain the privileges of the user account or service account running the affected process.
How could an attacker exploit this vulnerability?
An authenticated attacker with low privileges could send specially crafted requests to write files to locations accessible to the affected web application. Successful exploitation could allow the attacker to gain the privileges of the application-pool identity or compromise other users’ sessions.
Security updates
11.0.50736.0 — https://support.microsoft.com/en-gb/servicing/dynamics/nav/update/2022/12/cumulative-update-60-for-microsoft-dynamics-nav-2018-build-49618
Vulnerabilities 1
-
High 8.8
Dynamics Business Central Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-102226 Dynamics Business Central Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102226
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss