Dynamics 365 Business Central: Path traversal leads to privilege escalation
Summary
A path traversal flaw (CWE-22) in Microsoft Dynamics Business Central allows an authorized attacker to elevate privileges over the network. The attacker needs a valid low-privilege account but no user interaction. A secondary source lists the issue for Dynamics NAV 2018, so on-premises installations are the main concern.
Affected
- Business Central: unconfirmed.
- A secondary source lists Microsoft Dynamics NAV 2018 from 1.0 to before 11.0.50736.0. Not verified against Microsoft.
Fixed in
Unknown. No verified fixed build found; check the Microsoft advisory.
Workaround
- No vendor workaround found in the sources.
- Interim measures (general practice, not from a source): limit who holds valid Business Central/NAV accounts, restrict network exposure of on-premises servers, review logs for unusual file access.
Exploitation
- No evidence of exploitation in the wild.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in KEV. EPSS 0.00917.
- No public proof of concept found.
Our recommendation
- Check whether on-premises Business Central or NAV 2018 servers are in use.
- Prioritise those servers, especially if reachable from the internet or shared with many users.
- Apply the Microsoft update once the fixed build is confirmed; check CVE-2026-105727 too.
- Restrict accounts and network access, and monitor logs.
- Business Central SaaS is patched by Microsoft.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-102226 msrc.microsoft.com
- NVD mirror on vulners: CVE-2026-102226 vulners.com
- Strix CVE record: CVE-2026-102226 www.strix.ai
- threatint CVE record: CVE-2026-102226 cve.threatint.com
- Nessus plugin for Dynamics NAV 2018 (October 2026 updates) vulners.com
- Microsoft Security Update Guide: CVE-2026-105727 (sibling CVE) msrc.microsoft.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:33.
Original description (NVD)
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.