Vulnerability · Published Dec 13, 2022 · Assigned by microsoft

CVE-2022-41127Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

High 8.5

In plain English

A high-severity security flaw in Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)1.7%top 22.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Affected products (as reported)

Vendor	Product	Versions
Microsoft	Microsoft Dynamics NAV 2016	1.0 – before Build 52203
Microsoft	Microsoft Dynamics NAV 2017	1.0 – before Build 30712
Microsoft	Microsoft Dynamics NAV 2018	1.0 – before Build 49497
Microsoft	Microsoft Dynamics NAV 2015	1.0 – before 52204
Microsoft	Dynamics 365 Business Central Spring 2019 Update	14.0.0 – before App Build 14.43.49498, Platform Build 14.0.49494
Microsoft	Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)	15.0.0 – before App Build 15.17.48428, Platform Build 15.0.48
Microsoft	Microsoft Dynamics 365 Business Central 2020 Release Wave 2	17.0.0 – before App Build 17.17.38111, Platform Build 17.0.38061
Microsoft	Microsoft Dynamics 365 Business Central 2020 Release Wave 1	16.0.0 – before App Build 16.19.35126, Platform Build 16.35120
Microsoft	Microsoft Dynamics 365 Business Central 2022 Release Wave 1	20.0.0 – before App Build 20.8.49971, Platform Build 20.0.49947
Microsoft	Microsoft Dynamics 365 Business Central 2021 Release Wave 2	19.0.0 – before App Build 19.14.49970, Platform Build 19.0.49925
Microsoft	Microsoft Dynamics 365 Business Central 2022 Release Wave 2	21.0.0 – before App Build 21.2.49990, Platform Build 21.0.49984
Microsoft	Microsoft Dynamics 365 Business Central 2021 Release Wave 1	18.0.0 – before App Build 18.18.46920, Platform Build 18.0.46905
Microsoft	Microsoft Dynamics NAV 2013 R2	1.0 – before 52297

References

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability vendor-advisory