Dynamics Business Central EUVD-2026-100328

Exploitation requires a valid authenticated Business Central account with at least low privileges (PR:L) and network reachability to the application's deserialization endpoint; the attacker must be able to submit untrusted serialized data that the application deserializes (CWE-502). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a foothold account exists, exploitation is straightforward. The principal limiting factors are the authentication requirement - this is not unauthenticated RCE - and network exposure of the vulnerable endpoint; instances where Business Central is not network-accessible to the attacker, or where account provisioning is tightly controlled, materially reduce real-world risk. Specific vulnerable versions and configuration modes are not detailed in the available data and should be confirmed against the MSRC advisory.

This is a credible mid-to-high priority issue, though not a drop-everything emergency on current signals. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity deserialization flaw (CWE-502) that yields full confidentiality, integrity, and availability impact (C:H/I:H/A:H) - consistent with remote code execution in an ERP backend. The key tempering factor is PR:L: an attacker must already hold a valid, low-privileged authenticated account on the Business Central instance, so this is post-authentication rather than fully unauthenticated RCE. No EPSS probability, CISA KEV listing, SSVC decision data, or POC indicator is present in the supplied intelligence, so exploitation likelihood cannot be quantified from the data - there is no public exploit identified at time of analysis, and no evidence of active exploitation. The signals are internally consistent (network vector matches the 'execute code over a network' description; authorized-attacker language matches PR:L), so there is no CVSS-versus-description conflict to flag. Overall: a genuine RCE-class bug that warrants prompt patching, but the authentication requirement and absence of any exploitation/POC signal place it below internet-facing unauthenticated criticals.

An attacker who has obtained a legitimate low-privileged Business Central user account (e.g., via phishing, a compromised partner/customer login, or an insider) sends a crafted serialized payload to a network-exposed endpoint that deserializes it without validation. The unsafe deserialization instantiates attacker-controlled objects, leading to arbitrary code execution on the application server with full impact on the ERP data and host. No public exploit code is identified at time of analysis, and low attack complexity (AC:L) means no special timing or race conditions are required once authenticated.