What is the CVSS score of CVE-2026-40417?

CVE-2026-40417 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-40417?

Within 24 hours: Identify all instances of Microsoft Dynamics 365 Business Central running versions 2024 Release Wave 2 through 2026 Release Wave 1 in your environment and document their locations and data sensitivity. Within 7 days: Apply the vendor-released patch to all affected instances according to your change control process, prioritizing production environments first; test patches in a non-production environment before production deployment. Within 30 days: Verify that all instances have been successfully patched, audit access logs for signs of unauthorized privilege escalation attempts, and document completion in your patch management system.

Microsoft Dynamics 365 Business Central 2024 Release Wave 2 CVE-2026-40417

Q: Which versions of Microsoft Dynamics 365 Business Central 2024 Release Wave 2 are affected by CVE-2026-40417?

Microsoft Dynamics 365 Business Central (versions 2024 Release Wave 2 through 2026 Release Wave 1) contains a local privilege escalation vulnerability affecting authenticated users with low…. A patch is available.

EUVD-2026-29674 HIGH

Weak Authentication (CWE-1390)

2026-05-12 microsoft

GHSA-x37p-2fc6-57xh

Information Disclosure Microsoft Microsoft Dynamics 365 Business Central 2024 Release Wave 2 Microsoft Dynamics 365 Business Central 2026 Release Wave 1 Microsoft Dynamics 365 Business Central Release Wave 1 2025 Microsoft Dynamics 365 Business Central Release Wave 2 2025

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:59 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

HIGH 7.8

DescriptionCVE.org

Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Dynamics 365 Business Central (2024 Release Wave 2 through 2026 Release Wave 1) lets an already-authenticated, low-privileged user elevate to higher privileges on the host through a weak authentication mechanism (CWE-1390). Successful exploitation yields total compromise of confidentiality, integrity, and availability of the affected instance. There is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as 'none' with an EPSS of just 0.04% (12th percentile), indicating low near-term exploitation likelihood.