MSRC-CVE-2026-55944 — Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by sending a specially crafted login request to an affected Dynamics NAV or Business Central server. Successful exploitation could allow the attacker to execute arbitrary code on the target system. Authentication and user interaction are not required.

Security updates
11.0.50704.0 — https://support.microsoft.com/en-US/servicing/dynamics/nav/update/2022/12/cumulative-update-60-for-microsoft-dynamics-nav-2018-build-49618

Vulnerabilities 1

Critical 9.8

CVE-2026-55944 Public exploit

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.

Microsoft Microsoft Dynamics NAV 2018

Jul 14, 2026

Revision history

2026-07-14 #1
Information published.

References

CVE-2026-55944 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55944
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss