Dynamics Business Central CVE-2026-102226

Exploitation requires an authenticated account with at least low privileges on the target Dynamics Business Central instance (CVSS PR:L; description states 'authorized attacker'), so unauthenticated anonymous access is not sufficient. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N) against a running instance. The core prerequisite is network access to the Business Central application endpoint plus valid credentials; the limiting factor is that the attacker must already be an authorized user, which confines the threat to insiders or holders of compromised/low-tier accounts rather than arbitrary remote attackers. No specific non-default feature toggle is named in the description beyond the path-handling code path itself.

CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a network-exploitable, low-complexity flaw requiring only low-level authentication (PR:L) and no user interaction, with high confidentiality, integrity, and availability impact - consistent with a privilege-escalation path-traversal (CWE-22) in Dynamics Business Central. No EPSS score was provided in the input, so exploitation probability cannot be quantified. KEV status is not present, so there is no confirmation of active exploitation, and no POC was supplied, so no public exploit identified at time of analysis. SSVC inputs (exploitation status, automatable, technical impact) were not provided and cannot be assessed. The signals therefore point to a genuinely serious vulnerability on paper (high CVSS, network vector, low barrier for an already-authenticated user) but with no evidence of real-world exploitation or public tooling, so this is a high-priority patching candidate rather than an emergency; the requirement for an existing authorized account (PR:L) meaningfully narrows the attacker population compared with an unauthenticated flaw.

An attacker who already holds a low-privileged authenticated account on a Dynamics Business Central instance sends crafted requests over the network containing manipulated pathname input that escapes the intended restricted directory. By traversing to privileged files or resources, the attacker reads or modifies data outside their authorization boundary and elevates their privileges. No public exploit code or active exploitation is identified at time of analysis, and no user interaction is required.