Medium · 5.5 CVE-2025-29821 EUVD-2025-10128GHSA-386h-wcf4-977x

Microsoft Dynamics Business Central Information Disclosure Vulnerability

Published Apr 8, 2025 · Updated Aug 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft Dynamics 365 Business Central 2023 Wave 2 Product: Microsoft Dynamics 365 Business Central 2024 Wave 1 2024 Product: Microsoft Dynamics 365 Business Central 2024 Wave 2 Product: Microsoft Dynamics 365 Business Central 2025 Wave 1

Description

Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Microsoft Dynamics 365 Business Central 2023 Wave 2	23.0 – < 23.0.32309	23.0.32309
Microsoft	Microsoft Dynamics 365 Business Central 2024 Wave 1 2024	24.0 – < 24.0.32305	24.0.32305
Microsoft	Microsoft Dynamics 365 Business Central 2024 Wave 2	25.0 – < 25.2.32308	25.2.32308
Microsoft	Microsoft Dynamics 365 Business Central 2025 Wave 1	26.0 – < 26.0.32481	26.0.32481

Advisories 3

MSRC-CVE-2025-29821 Microsoft Dynamics Business Central Information Disclosure Vulnerability Microsoft Security Response Center · Aug 10, 2026
WID-SEC-2025-0747 Microsoft Dynamics 365: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Apr 8, 2025
NCSC-2025-0111 Kwetsbaarheid verholpen in Microsoft Dynamics NCSC-NL (Netherlands) · Apr 8, 2025

References

Microsoft Dynamics Business Central Information Disclosure Vulnerability vendor-advisory patch