7.8
High
CVE-2026-40417 Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally
Description
Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Dynamics 365 Business Central 2024 Release Wave 2 25.0 | 25.0 → < 25.2.48119 | 25.2.48119 |
| Microsoft Dynamics 365 Business Central 2026 Release Wave 1 28.0 | 28.0 → < 28.0.49873 | 28.0.49873 |
| Microsoft Dynamics 365 Business Central Release Wave 1 2025 26.0 | 26.0 → < 26.0.48120 | 26.0.48120 |
| Microsoft Dynamics 365 Business Central Release Wave 2 2025 27.0 | 27.0 → < 27.0.48102 | 27.0.48102 |