CVE-2026-40417: Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Overview

Severity

High (CVSS 7.8)

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-May

Released

2026-05-12

Description

Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.

FAQ

What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Affected Products (4)

Microsoft Dynamics

• Microsoft Dynamics 365 Business Central 2026 Release Wave 1
• Microsoft Dynamics 365 Business Central Release Wave 1 2025
• Microsoft Dynamics 365 Business Central Release Wave 2 2025
• Microsoft Dynamics 365 Business Central 2024 Release Wave 2

Security Updates (4)

• 5093780
• 5086069
• 5086070
• 5086068

Acknowledgments

<a href="https://x.com/__nhienit__">Nhien Pham (@nhienit)</a> with Galaxy One

Revision History

• 2026-05-12: Information published.