Summary
Microsoft heeft kwetsbaarheden verholpen in diverse Dynamics componenten.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade zoals benoemd in onderstaande tabellen:
Microsoft Dataverse:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-88131 | 9.80 | Uitvoeren van willekeurige code |
|------------------|------|-------------------------------------|
Dynamics Business Central:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-100214 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-102226 | 8.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-105727 | 8.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-105728 | 7.50 | Toegang tot gevoelige gegevens |
|------------------|------|-------------------------------------|
Microsoft Dynamics 365 (on-premises):
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-102848 | 8.10 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|
Microsoft Power Apps:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-70213 | 8.00 | Uitvoeren van willekeurige code |
|------------------|------|-------------------------------------|
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 5
-
Critical 9.8
Microsoft Dataverse Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
-
High 8.8
Dynamics Business Central Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
External control of file name or path in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Microsoft Power Apps Remote Code Execution Vulnerability
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
Revision history
-
#1.0.0
Initiele versie