Dynamics Business Central: Information disclosure via missing authentication
Summary
Improper authentication in Microsoft Dynamics Business Central allows an unauthenticated attacker to disclose information over the network. Microsoft's CNA data names Dynamics NAV 2018 instead, and the affected Business Central versions are unknown, so verify which products are affected on the MSRC page. According to Microsoft, the disclosed information is file path information, which mainly helps an attacker plan further attacks. Exposure is highest where the ERP service is reachable from the internet.
Affected
- Microsoft Dynamics NAV 2018 (per CNA data, on Windows Server 2012): versions from 1.0 before 11.0.50736.0
- Dynamics Business Central: Unknown.
Fixed in
- Dynamics NAV 2018: build 50736 or later (per third-party scanner; confirm via the MSRC "Download Security Update" link)
- Dynamics Business Central: Unknown.
Workaround
Unknown. No vendor-published workaround found.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- Microsoft temporal rating E:U (exploit code unproven).
- EPSS about 0.0099 (low predicted exploitation probability).
- A third-party aggregator reports the CVE is not in CISA KEV; not verified directly.
Our recommendation
- Identify whether Dynamics NAV 2018 or Business Central on-premises is in use and which build is installed.
- Apply the fixed build listed on the MSRC page.
- Confirm that ERP service ports are not reachable from the internet; restrict access via VPN or allow-listing.
- Check Business Central servers for CVE-2026-40375 as well.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (CVE-2026-105728) msrc.microsoft.com
- Microsoft Security Update Guide, en-US (CVE-2026-105728) msrc.microsoft.com
- NVD record via Vulners (CVE-2026-105728) vulners.com
- CVE List record via Vulners (CVE-2026-105728) vulners.com
- Nessus plugin for NAV 2018 October 2026 updates (third-party) vulners.com
- SentinelOne: CVE-2026-40375 (related Business Central CVE) www.sentinelone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:33.
Original description (NVD)
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.