Business Central EUVD-2026-99029

Exploitation requires an authenticated session with at least low-level privileges on Microsoft Dynamics Business Central (CVSS PR:L), reachable over the network (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific limiting factor is the authentication requirement - the attacker must already hold a valid, low-privileged account, so purely anonymous/remote exploitation is not indicated. The exact vulnerable feature or endpoint performing unsafe pathname handling is not named in the description beyond the CWE-22 path-traversal behavior; defenders should restrict and monitor low-privilege account access and apply the MSRC-listed update. No special non-default configuration is stated as required.

This is a credible operational priority rather than a paper-high CVSS. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity path traversal (CWE-22) that requires only low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact on the component. The net effect per the description is privilege elevation, meaning an already-authenticated low-privileged user can escalate - a dangerous combination in a multi-tenant/shared ERP context where many users hold low-level accounts. That said, several escalation signals are MISSING from the input: there is no EPSS score, no KEV listing, and no POC indicator provided, so active exploitation and real-world exploit probability cannot be confirmed from this data. The only reference is the vendor MSRC advisory (NVD content is 'None'), so there is no third-party corroboration of exploitation. Conclusion: treat as high-priority patching for exposed/multi-user Business Central deployments because of the low attack complexity and authenticated-but-low bar, while recognizing that exploitation likelihood (EPSS/KEV/POC) is unverified from the available sources.

A low-privileged but authenticated Business Central user sends crafted input containing directory-traversal sequences to a file- or path-handling function reachable over the network, causing the application to read or write resources outside the intended restricted directory. By reaching privileged files or code paths, the attacker elevates their privileges within the application. No public proof-of-concept is identified in the provided data, and the low attack complexity (AC:L) means no special timing or conditions are needed once authenticated.