EUVD-2026-56299
GHSA-7w96-3fg4-2p29
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible ERP with authenticated-only exploitation (PR:L); missing authorization causes full confidentiality loss with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.
AnalysisAI
Missing authorization controls in Microsoft Dynamics 365 Business Central enable authenticated network attackers to access sensitive business data beyond their permitted scope. Rooted in CWE-862 (Missing Authorization), the flaw affects multiple release waves spanning 2024 through 2026, with a CVSS 6.5 score reflecting high confidentiality impact at low attack complexity. No public exploit code is identified and CISA SSVC rates exploitation as none and non-automatable, though the high confidentiality impact warrants prompt patching for organizations with broad user bases.
Technical ContextAI
Microsoft Dynamics 365 Business Central is a cloud-hosted and on-premises ERP platform serving SMB and mid-market enterprises, accessible via web browser and API. CWE-862 (Missing Authorization) identifies the root cause as the application failing to perform authorization checks on one or more operations or data endpoints before returning information. Unlike authentication failures, CWE-862 flaws occur after a user is authenticated - the application does not verify whether the authenticated user's role or permissions actually entitle them to the requested resource. The CVSS vector AV:N confirms the vulnerable endpoint is reachable over the network, consistent with Business Central's HTTP/API surface. Affected release branches span version 26.0 (Wave 1 2025), 27.0 (Wave 2 2025), and 28.0 (Wave 1 2026), suggesting the issue may exist across a shared code path introduced or regressed across multiple release cycles.
RemediationAI
The primary fix is to apply Microsoft's vendor-released patches: upgrade Business Central Release Wave 1 2025 to version 26.0.50788 or later, Release Wave 2 2025 to version 27.0.50789 or later, and Release Wave 1 2026 to version 28.0.50938 or later. Organizations on the 2024 Release Wave 2 branch should consult the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40375 for the specific fix version, as it was not independently confirmed in available data. For SaaS deployments of Business Central, Microsoft typically applies security updates automatically - verify update status in the admin portal. As an interim compensating control for on-premises or manually-updated instances, audit and minimize active low-privilege user accounts, applying the principle of least privilege to reduce the pool of accounts capable of triggering the unauthorized disclosure. Note that restricting network-level access to Business Central is generally not viable without impacting legitimate business operations.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today