Known vulnerabilities in Microsoft Dynamics 365 Business Central

Vendor: Microsoft
Software: Microsoft Dynamics 365 Business Central
Software CPE: cpe:2.3:a:microsoft:microsoft_dynamics_365_business_central:*:*:*:*:*:*:*:*
Website: https://www.microsoft.com
Total vulnerabilities: 13
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Microsoft Dynamics 365 Business Central Microsoft Dynamics 365 Business Central is affected by 13 known vulnerabilities: 6 medium, 7 low Critical High Medium Low

Vulnerabilities (13)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU141570 - Missing Authorization
CVE-2026-40375		 CWE-862 Medium
No
No
 26.0.50788, 27.0.50789, 28.0.50938 12.08.2026 SB2026081265
#VU131316 - Weak Authentication
CVE-2026-40417		 CWE-1390 Low
No
No
 25.18, 26.12, 27.6, 28.1 13.05.2026 SB2026051330
#VU107193 - Improper input validation
CVE-2025-29821		 CWE-20 Low
No
No
 - 08.04.2025 SB2025040864
#VU97090 - Improper Authentication
CVE-2024-38225		 CWE-287 Medium
No
No
 - 10.09.2024 SB20240910130
#VU91719 - Improper Authentication
CVE-2024-35248		 CWE-287 Medium
No
No
 - 11.06.2024 SB20240611244
#VU91718 - Deserialization of Untrusted Data
CVE-2024-35249		 CWE-502 Medium
No
No
 - 11.06.2024 SB20240611244
#VU86419 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-21380		 CWE-362 Medium
No
No
 - 13.02.2024 SB2024021348
#VU79152 - Permissions, Privileges, and Access Controls
CVE-2023-38167		 CWE-264 Low
No
No
 - 08.08.2023 SB2023080868
#VU70212 - Improper input validation
CVE-2022-41127		 CWE-20 Medium
No
No
 - 13.12.2022 SB2022121380
#VU69138 - Exposure of sensitive information to an unauthorized actor
CVE-2022-41066		 CWE-200 Low
No
No
 - 09.11.2022 SB2022110902
#VU56507 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-40440		 CWE-79 Low
No
No
 - 14.09.2021 SB2021091419
#VU55732 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-36946		 CWE-79 Low
No
No
 - 10.08.2021 SB2021081039
#VU54815 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-34474		 CWE-94 Low
No
No
 - 13.07.2021 SB2021071365