Detections
Analytics
Security Updates for Microsoft Dynamics 365 Business Central (May 2026) (CVE-2026-40417)
high Nessus Plugin ID 314959
Synopsis
The Microsoft Dynamics 365 Business Central install is missing a security update.Description
The Microsoft Dynamics 365 Business Central install is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability:- Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.
(CVE-2026-40417)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update Microsoft Dynamics 365 Business Central to Update 25.18 for 2024 Release Wave 2, Update 26.12 for 2025 Release Wave 1, Update 27.6 for 2025 Release Wave 2, Update 28.1 for 2026 Release Wave 1, or later.See Also
https://support.microsoft.com/help/5086068
https://support.microsoft.com/help/5086069
Plugin Details
Severity: High
ID: 314959
File Name: smb_nt_ms26_may_microsoft_dynamics_365_bc.nasl
Version: 1.1
Type: Local
Agent: windows
Family: Windows : Microsoft Bulletins
Published: 5/15/2026
Updated: 5/15/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-40417
CVSS v3
Risk Factor: High
Base Score: 7.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/a:microsoft:dynamics_365
Required KB Items: installed_sw/Microsoft Dynamics 365 Business Central Server
Patch Publication Date: 5/12/2026
Vulnerability Publication Date: 5/12/2026
Reference Information
CVE: CVE-2026-40417