CVE-2026-102226: Dynamics Business Central Elevation of Privilege Vulnerability
Dynamics Business Central Elevation of Privilege Vulnerability
Other sources
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.50736.0
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized and able to reach the affected system over the network. The available information does not indicate that unauthenticated attackers can exploit it.
What access could a successful attacker gain?
Successful exploitation allows an authorized attacker to elevate privileges. The severity vector indicates high impact to confidentiality, integrity, and availability.
Which products should be included in triage?
Triage Microsoft Dynamics 365 Business Central and Microsoft Dynamics NAV 2018 deployments. The provided data does not identify affected or fixed versions within those products.
Is a default configuration known to be affected?
The available information does not state whether default configurations are affected or identify any required feature, module, or configuration setting.