CVE-2026-100214: Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
Other sources
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 30713 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.50736.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authorized and able to reach the affected Dynamics 365 Business Central or Dynamics NAV instance over the network. No user interaction is required.
What level of impact could successful exploitation have?
Successful exploitation can allow remote code execution. The supplied severity vector indicates high impacts to confidentiality, integrity, and availability.
Are Microsoft Dynamics NAV deployments also in scope?
Yes. The affected software list includes Microsoft Dynamics NAV 2017 and Microsoft Dynamics NAV 2018, in addition to Microsoft Dynamics 365 Business Central.