EUVD-2026-99030
GHSA-5v28-9f55-qxwj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify reachable Business Central endpoint
-
ExploitSend request to unauthenticated function
-
ExecutionBypass missing authentication check
-
ImpactRetrieve sensitive data in response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a Dynamics Business Central instance that exposes the affected endpoint; per AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special client-side conditions are needed against an affected deployment. The practical limiting factors are therefore network exposure (internet-facing or attacker-reachable intranet instances are at highest risk; instances isolated behind VPN/firewall are far less exposed) and whether the deployment runs an affected, unpatched version - the single MSRC reference does not enumerate affected versions or whether specific configurations/modules are required, so defenders should confirm exposure against the vendor advisory. Impact is limited to information disclosure only (I:N/A:N): no data modification or service disruption results directly from this flaw. |
| Impact | This is a credible, above-average-priority information-disclosure flaw, but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exposure profile: fully remote, low-complexity, unauthenticated, no user interaction, with high confidentiality impact (C:H) and no integrity or availability impact - consistent with CWE-306 (Missing Authentication for a Critical Function) and the 'Authentication Bypass' tag. The score of 7.5 is driven entirely by data exposure, not system compromise. Signals are thin beyond CVSS: no EPSS score was provided, the vulnerability is NOT on the CISA KEV list, and no public proof-of-concept is referenced (the only reference is the vendor MSRC advisory). So while the technical pre-conditions for exploitation are minimal, there is currently no evidence of real-world weaponization - the risk is 'easy to exploit if someone builds it' rather than 'being actively exploited.' One point to verify with the vendor: the description says 'disclose information over a network' without specifying WHAT information (configuration, business records, credentials/tokens), and the public MSRC entry does not enumerate affected versions or data classes - treat the C:H rating as vendor-asserted rather than independently characterized. |
| Exploit ScenarioDerived | A remote attacker, without any credentials, sends crafted requests to an internet-exposed or network-reachable Dynamics Business Central endpoint that fails to enforce authentication, and receives back sensitive data that should have required a valid session. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no phishing, foothold, or user interaction is needed. No public exploit code has been identified at time of analysis, so this scenario is based on the vector rather than an observed exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated information disclosure in Microsoft Dynamics 365 Business Central allows any attacker who can reach an affected instance over the network to read sensitive data without credentials, user interaction, or any special client-side condition (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The flaw is root-caused to CWE-306 (Missing Authentication for Critical Function) and is strictly a confidentiality issue: no data modification or service disruption results from the bug itself, and no public exploit identified at time of analysis. Practical risk is governed almost entirely by network reachability and patch level, making this a credible, above-average-priority information-disclosure flaw rather than an emergency.
RemediationAI
The primary action is to consult the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105728, confirm whether the deployment's build or cumulative update level falls in the affected range, and apply the vendor-released update it identifies - the supplied data does not include an exact fix version, so no specific build number should be assumed or invented. Because patch availability for this CVE is documented through the MSRC advisory rather than a separate versioned reference here, treat it as patch available per vendor advisory and verify the fixed build against that page before closing the finding. For on-premises instances, the highest-value compensating control is to remove direct untrusted network reachability to the Business Central web/API surface: terminate access behind a VPN or private network path, restrict inbound rules to known client IP ranges, and avoid publishing the service to the internet while unpatched - the trade-off is reduced usability for remote and mobile users, who must then connect through the VPN or an authenticated reverse proxy. Additional hardening includes enforcing authentication and authorization at a fronting reverse proxy or WAF for the affected endpoints and enabling detailed request logging on the Business Central tier so that anonymous access attempts to unexpected paths are visible for detection, though a WAF rule is a detection-and-friction layer rather than a substitute for the missing authentication check and may be bypassed by alternate paths. Cloud-hosted customers have no self-service patch path and should track the MSRC advisory and Microsoft 365 service health notices for remediation status rather than attempting local changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an authentication-enforcement failure in Microsoft Dynamics 365 Business Central, an ERP platform that Microsoft delivers both as a managed cloud service and as an on-premises/full-trust deployment. CWE-306 (Missing Authentication for Critical Function) means a function or endpoint that should require authentication does not verify it, so the code path returns data to any caller who can reach it. Combined with the assessed vector AV:N/AC:L/PR:N/UI:N, the affected surface is network-facing and needs no credentials, no user interaction, and no privileged network position beyond reachability; the AC:L rating implies the endpoint can be exercised without unusual timing, race, or memory-layout conditions. CWE-306 is distinct from broken authorization (CWE-862/863) in that no identity at all is established before the sensitive operation executes, which is why the assessed impact is a clean high-confidentiality (C:H) disclosure with no integrity or availability effect. The provided intelligence set does not include CPE strings, so exact affected builds, module names, and the specific endpoint are not enumerated here; the single authoritative reference is the Microsoft Security Response Center update guide for CVE-2026-105728, and no alternate vendor, upstream commit, or research write-up was supplied to corroborate or narrow the affected surface further.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-306 missing authentication supports PR:N/AC:L over the network; impact is confidentiality-only (C:H, I:N, A:N) as the flaw discloses information without altering the system.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
Executive ViewAI
Microsoft Dynamics 365 Business Central is affected by a high-severity unauthenticated information-disclosure flaw that can allow a network-reachable attacker to read sensitive business data without credentials. No public exploit identified at time of analysis, but because no vendor-released patch was identified at time of analysis, leadership should prioritize reducing network exposure to protect financial, operational, and customer data from unauthorized disclosure.
No vendor-released patch identified at time of analysis; restrict network reachability to affected Microsoft Dynamics 365 Business Central instances, enforce VPN/zero-trust access and IP allowlists, segment the service from general corporate networks, and monitor for anomalous read/query activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB