High · 7.8 CVE-2026-40417 EUVD-2026-29674GHSA-x37p-2fc6-57xh

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Published May 12, 2026 · Updated Aug 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft Dynamics 365 Business Central 2024 Release Wave 2 Product: Microsoft Dynamics 365 Business Central 2026 Release Wave 1 Product: Microsoft Dynamics 365 Business Central Release Wave 1 2025 Product: Microsoft Dynamics 365 Business Central Release Wave 2 2025

Description

Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Microsoft Dynamics 365 Business Central 2024 Release Wave 2	25.0 – < 25.2.48119	25.2.48119
Microsoft	Microsoft Dynamics 365 Business Central 2026 Release Wave 1	28.0 – < 28.0.49873	28.0.49873
Microsoft	Microsoft Dynamics 365 Business Central Release Wave 1 2025	26.0 – < 26.0.48120	26.0.48120
Microsoft	Microsoft Dynamics 365 Business Central Release Wave 2 2025	27.0 – < 27.0.48102	27.0.48102

Advisories 3

MSRC-CVE-2026-40417 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability Microsoft Security Response Center · Aug 10, 2026
WID-SEC-2026-1485 Microsoft Dynamics 365: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 12, 2026
NCSC-2026-0145 Kwetsbaarheden verholpen in Microsoft Dynamics NCSC-NL (Netherlands) · May 12, 2026

References

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability vendor-advisory patch