Microsoft Dynamics Nav vulnerabilities

10 CVEs affecting Microsoft Dynamics Nav, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-55944, published 2026-07-14.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-0905, published 2020-03-12. High severity, CVSS 8.0. EPSS: 10.8% chance of exploitation in the next 30 days. An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'.
• CVE-2020-1022, published 2020-04-15. High severity, CVSS 8.0. EPSS: 6.8% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability'.
• CVE-2020-1018, published 2020-04-15. High severity, CVSS 7.5. EPSS: 6.3% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The…
• CVE-2020-17133, published 2020-12-10. Medium severity, CVSS 6.5. EPSS: 3.8% chance of exploitation in the next 30 days. Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
• CVE-2022-41127, published 2022-12-13. High severity, CVSS 8.5. EPSS: 1.7% chance of exploitation in the next 30 days. Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
• CVE-2026-55944, published 2026-07-14. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.
• CVE-2018-8651, published 2018-12-12. Medium severity, CVSS 5.4. EPSS: 1.5% chance of exploitation in the next 30 days. A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV…
• CVE-2021-1724, published 2021-02-25. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
• CVE-2022-41066, published 2022-11-09. Medium severity, CVSS 4.4. EPSS: 1.2% chance of exploitation in the next 30 days. Microsoft Dynamics Business Central Information Disclosure Vulnerability
• CVE-2021-36946, published 2021-08-12. Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days. Microsoft Dynamics Business Central Cross-site Scripting Vulnerability