VYPR
← All advisories
High severity7.8NVD Advisory· Published May 12, 2026· Updated Aug 10, 2026

CVE-2026-40417

CVE-2026-40417

Description

Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.

Affected products

5
  • Microsoft/Dynamics 365 Business Central4 versions
    cpe:2.3:a:microsoft:dynamics_365_business_central:2024:release_wave_2:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:microsoft:dynamics_365_business_central:2024:release_wave_2:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:dynamics_365_business_central:2025:release_wave_1:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:dynamics_365_business_central:2025:release_wave_2:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:dynamics_365_business_central:2026:release_wave_1:*:*:*:*:*:*
  • Microsoft/Dynamics Business Centralllm-fuzzy

Patches

Vulnerability mechanics

References

1

News mentions

2