CVE-2025-29821: Microsoft Dynamics 365 Business Central 2023

Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.

Affected products

• Microsoft Dynamics 365 Business Central 2023: from 23.1.13812, before 23.18.32409 (fixed in 23.18.32409)
• Microsoft Dynamics 365 Business Central 2024: before 24.12.32447 (fixed in 24.12.32447); from 25.1.25900, before 25.6.32556 (fixed in 25.6.32556)
• Microsoft Dynamics 365 Business Central 2025: before 26.0.32481 (fixed in 26.0.32481)

Published 2025-04-08. Last modified 2026-08-10.