What is the CVSS score of CVE-2026-55944?

CVE-2026-55944 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Which versions of Dynamics NAV are affected by CVE-2026-55944?

Microsoft Dynamics NAV 2018 contains a critical remote code execution vulnerability (CVSS 9.8) requiring no authentication, enabling unauthorized network-based attackers to fully compromise the ERP…. A patch is available.

How to fix or mitigate CVE-2026-55944?

Within 24 hours: Identify all Microsoft Dynamics NAV 2018 instances and apply the vendor patch released by Microsoft Security Response Center (MSRC); if patching cannot complete immediately, isolate affected systems from untrusted networks and implement network-level access controls. Within 7 days: Complete patch deployment across production, staging, and test environments, and verify successful application using MSRC-provided validation procedures. Within 30 days: Conduct a security assessment to identify any exploitation attempts before patch deployment by reviewing access logs and audit trails, and document the full remediation timeline for compliance and breach-notification protocols.

Dynamics NAV CVE-2026-55944

EUVD-2026-44229 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-14 microsoft

GHSA-rvmx-r962-429w

Deserialization Microsoft Microsoft Dynamics Nav 2018

9.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization needing no user interaction gives AV:N/AC:L/PR:N/UI:N, and code execution yields full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:13 vuln.today

CVE Published

Jul 14, 2026 - 17:09 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Dynamics NAV 2018 allows an unauthorized, network-based attacker to run arbitrary code by submitting maliciously crafted serialized data that the application deserializes without validation (CWE-502). With a CVSS 9.8 vector requiring no authentication and no user interaction, successful exploitation grants full compromise of the ERP host. Microsoft has released a patch via MSRC; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

The flaw is a CWE-502 unsafe deserialization issue in Microsoft Dynamics NAV, an on-premises ERP (Enterprise Resource Planning) platform for finance, supply chain, and operations. The affected CPE is cpe:2.3:a:microsoft:microsoft_dynamics_nav_2018, indicating the 2018 release line (the predecessor to Dynamics 365 Business Central). Insecure deserialization occurs when an application reconstructs .NET/serialized objects from attacker-controlled input without validating type or content; crafted gadget chains can then trigger code execution during object reconstruction. Because NAV exposes network-facing service endpoints (e.g., the NAV/Business Central Server service tier and web/SOAP/OData services), untrusted serialized payloads can reach the vulnerable deserialization path over the network.

RemediationAI

Patch available per vendor advisory - apply the Microsoft-supplied update for Dynamics NAV 2018 referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55944, which lists the exact fixed cumulative update to install (no exact fix build was provided in this input, so verify the target version directly in the MSRC guide). Until patching is complete, reduce exposure by restricting network access to the NAV Server service tier and any web/SOAP/OData endpoints to trusted management networks and VPN only, and remove any direct internet exposure of these services - the trade-off is that legitimate remote or integration clients outside the allowed ranges will lose connectivity and may require firewall or reverse-proxy allow-listing. Where feasible, place the service tier behind an application-aware gateway and monitor for anomalous serialized payloads; these controls reduce reachability but do not remove the underlying deserialization flaw, so they are stopgaps pending the patch.