MSRC-CVE-2026-40417 — Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Security updates
28.0.49873 — http://support.microsoft.com/kb/5093780
26.0.48120 — http://support.microsoft.com/kb/5086069
27.0.48102 — http://support.microsoft.com/kb/5086070
25.2.48119 — http://support.microsoft.com/kb/5086068

Vulnerabilities 1

High 7.8

CVE-2026-40417

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.

Microsoft Microsoft Dynamics 365 Business Central 2026 Release Wave 1 Microsoft Dynamics 365 Business Central Release Wave 2 2025 Microsoft Dynamics 365 Business Central Release Wave 1 2025

May 12, 2026

Revision history

2026-08-10 #2
Updated the build numbers. This is an informational update only.
2026-05-12 #1
Information published.

References

CVE-2026-40417 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40417
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss