Microsoft Dynamics 365 Business Central vulnerabilities

15 CVEs affecting Microsoft Dynamics 365 Business Central, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-40417, published 2026-05-12.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-0905, published 2020-03-12. High severity, CVSS 8.0. EPSS: 10.8% chance of exploitation in the next 30 days. An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'.
• CVE-2020-1022, published 2020-04-15. High severity, CVSS 8.0. EPSS: 6.8% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'.
• CVE-2020-1018, published 2020-04-15. High severity, CVSS 7.5. EPSS: 6.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The…
• CVE-2024-35249, published 2024-06-11. High severity, CVSS 8.8. EPSS: 3.4% chance of exploitation in the next 30 days. Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
• CVE-2021-34474, published 2021-07-14. High severity, CVSS 8.0. EPSS: 2.2% chance of exploitation in the next 30 days. Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
• CVE-2024-21380, published 2024-02-13. High severity, CVSS 8.0. EPSS: 1.7% chance of exploitation in the next 30 days. Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
• CVE-2022-41127, published 2022-12-13. High severity, CVSS 8.5. EPSS: 1.7% chance of exploitation in the next 30 days. Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
• CVE-2023-38167, published 2023-08-08. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
• CVE-2024-38225, published 2024-09-10. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
• CVE-2021-1724, published 2021-02-25. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. Microsoft Dynamics Business Central Cross-site Scripting Vulnerability

Latest

• CVE-2026-40417, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.
• CVE-2024-43460, published 2024-09-17. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network.
• CVE-2024-35248, published 2024-06-11. High severity, CVSS 7.3. EPSS: 1% chance of exploitation in the next 30 days. Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
• CVE-2021-40440, published 2021-09-15. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
• CVE-2021-36946, published 2021-08-12. Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days. Microsoft Dynamics Business Central Cross-site Scripting Vulnerability