6.5
Medium
CVE-2026-40375 Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network
Description
Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Dynamics 365 Business Central 2024 Release Wave 2 | Versions not published | |
| Microsoft Dynamics 365 Business Central 2026 Release Wave 1 28.0 | 28.0 → < 28.0.50938 | 28.0.50938 |
| Microsoft Dynamics 365 Business Central Release Wave 1 2025 26.0 | 26.0 → < 26.0.50788 | 26.0.50788 |
| Microsoft Dynamics 365 Business Central Release Wave 2 2025 27.0 | 27.0 → < 27.0.50789 | 27.0.50789 |
| Microsoft Dynamics NAV 2017 1.0 | 1.0 → < 30713 | 30713 |
| Microsoft Dynamics NAV 2018 1.0 | 1.0 → < 11.0.50736.0 | 11.0.50736.0 |
References
- Microsoft Dynamics Business Central Information Disclosure Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified