Medium · 6.5 CVE-2026-40375 EUVD-2026-56299GHSA-7w96-3fg4-2p29

Microsoft Dynamics Business Central Information Disclosure Vulnerability

Published Aug 11, 2026 · Updated Nov 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft Dynamics 365 Business Central 2026 Release Wave 1 Product: Microsoft Dynamics 365 Business Central Release Wave 1 2025 Product: Microsoft Dynamics 365 Business Central Release Wave 2 2025 Product: Microsoft Dynamics NAV 2017 Product: Microsoft Dynamics NAV 2018

Description

Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Microsoft Dynamics 365 Business Central 2026 Release Wave 1	28.0 – < 28.0.50938	28.0.50938
Microsoft	Microsoft Dynamics 365 Business Central Release Wave 1 2025	26.0 – < 26.0.50788	26.0.50788
Microsoft	Microsoft Dynamics 365 Business Central Release Wave 2 2025	27.0 – < 27.0.50789	27.0.50789
Microsoft	Microsoft Dynamics NAV 2017	1.0 – < 30713	30713
Microsoft	Microsoft Dynamics NAV 2018	1.0 – < 11.0.50736.0	11.0.50736.0

Advisories 3

WID-SEC-2026-2783 Microsoft Dynamics: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 13, 2026
NCSC-2026-0288 Kwetsbaarheden verholpen in Microsoft Dynamics NCSC-NL (Netherlands) · Aug 11, 2026
MSRC-CVE-2026-40375 Microsoft Dynamics Business Central Information Disclosure Vulnerability Microsoft Security Response Center · Aug 11, 2026

References

Microsoft Dynamics Business Central Information Disclosure Vulnerability vendor-advisory patch