Description
Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft Dynamics NAV 2018 | 1.0 – < 11.0.50704.0 | 11.0.50704.0 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
kipkorirchirchir800-hash/Cve-2026-55944 ★ 0 · Oct 27, 2026
This PoC simulates an XML parsing vulnerability where configuration data is parsed and passed directly to ProcessStartInfo. It extracts executable paths and arguments from XML markup to spawn a syste…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- WID-SEC-2026-2325 Microsoft Dynamics NAV: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jul 14, 2026
- NCSC-2026-0238 Kwetsbaarheid verholpen in Microsoft Dynamics NCSC-NL (Netherlands) · Jul 14, 2026
- MSRC-CVE-2026-55944 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability Microsoft Security Response Center · Jul 14, 2026