Microsoft Dynamics 365 Business Central: Path traversal allows privilege escalation
Summary
A path traversal weakness (CWE-22) in Microsoft Dynamics 365 Business Central allows an authorized user with a valid account to elevate privileges over the network. The CVSS vector requires low privileges and no user interaction, with high impact on confidentiality, integrity and availability. Microsoft's CNA record lists Dynamics NAV 2018 as affected, but the affected Business Central versions could not be confirmed.
Affected
- Microsoft Dynamics NAV 2018: versions 1.0 to below 11.0.50736.0 (CNA record; not confirmed on the MSRC page)
- Microsoft Dynamics 365 Business Central (on-premises): versions unconfirmed
- Attacker requires a valid, low-privileged account
Fixed in
- Dynamics NAV 2018: build 50736 or later, per a third-party Nessus plugin (unconfirmed; Cumulative Update 60 referenced)
- Business Central on-premises: Unknown. Check the MSRC page for the fixed build per product.
Workaround
Unknown. No vendor workaround was found.
Exploitation
- No known exploitation in the wild.
- Not listed in CISA KEV (per Strix aggregator).
- Microsoft exploit maturity: Unproven (E:U). EPSS score 0.00917.
- No public proof of concept found.
Our recommendation
- Identify whether you run Business Central (version, on-premises or online) or NAV 2018.
- Retrieve the fixed build for your product from the MSRC page and apply it.
- Retire any on-premises 26.x installation; a third-party source states it reaches end of life on 13 October 2026 (verify with Microsoft).
- Review accounts with access to the service and remove unneeded users until patched.
- Restrict network access to the server.
- Recheck NVD and the MSRC page once NVD analysis is complete.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-105727 msrc.microsoft.com
- NVD record via Vulners vulners.com
- Strix: CVE-2026-105727 www.strix.ai
- Tenable Nessus plugin for Dynamics NAV 2018 (via Vulners) vulners.com
- Microsoft: Update 28.6 for Business Central 2026 release wave 1 support.microsoft.com
- Microsoft: Released updates for Business Central 2026 release wave 1 support.microsoft.com
- Lansweeper: Microsoft Dynamics end of life (third-party, unverified) www.lansweeper.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:13.
Original description (NVD)
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.