CVE-2026-40375
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.
Risk Assessment
The risk of unauthorized access to business data by users with limited privileges.
Recommendation
Review and strengthen authorization mechanisms in Dynamics Business Central and apply relevant patches.
Other vulnerabilities in Dynamics Business Central
See all- CVE-2026-105728High
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
- CVE-2026-105727High
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
- CVE-2026-102226High
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
- CVE-2026-100214High
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
- CVE-2025-29821Medium
A vulnerability in Dynamics Business Central is due to improper input validation, allowing an authorized attacker to disclose information locally.
Original NVD description (English source)
Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS