CVE-2026-40375: Microsoft Dynamics 365 Business Central 2024

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.

Affected products

• Microsoft Dynamics 365 Business Central 2024: from 25.1.25900
• Microsoft Dynamics 365 Business Central 2025: from 26.0, before 26.0.50788 (fixed in 26.0.50788); from 27.0, before 27.0.50789 (fixed in 27.0.50789)
• Microsoft Dynamics 365 Business Central 2026: from 28.0, before 28.0.50938 (fixed in 28.0.50938)

Published 2026-08-11. Last modified 2026-08-13.