CVE-2024-35249: Dynamics 365 Business Central RCE Flaw

CVE-2024-35249 Overview

CVE-2024-35249 is a remote code execution vulnerability in Microsoft Dynamics 365 Business Central. The flaw is tracked as an insecure deserialization weakness [CWE-502] and allows an authenticated attacker to execute arbitrary code on the server. Microsoft rates the issue as high severity with a network attack vector and low privilege requirement. Successful exploitation compromises confidentiality, integrity, and availability of the affected Business Central instance. The vulnerability affects the 2023 and 2024 release waves of Dynamics 365 Business Central. No public exploit or in-the-wild activity has been documented, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
An authenticated network attacker can execute arbitrary code on the Business Central server, leading to full compromise of business data and downstream ERP integrations.

Affected Products

Microsoft Dynamics 365 Business Central 2023 Release Wave 1
Microsoft Dynamics 365 Business Central 2023 Release Wave 2
Microsoft Dynamics 365 Business Central 2024 Release Wave 1

Discovery Timeline

2024-06-11 - CVE-2024-35249 published to the National Vulnerability Database
2024-06-11 - Microsoft releases security update via MSRC advisory
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2024-35249

Vulnerability Analysis

CVE-2024-35249 is classified under CWE-502, Deserialization of Untrusted Data. Microsoft Dynamics 365 Business Central processes serialized objects received over the network without sufficient validation of their type or content. An attacker with valid low-privilege credentials can submit crafted serialized data to a vulnerable endpoint. When the server deserializes this payload, attacker-controlled gadget chains execute within the Business Central process context. The outcome is arbitrary code execution on the application server hosting the ERP workload. Because Business Central often integrates with finance, supply chain, and identity systems, compromise extends beyond the ERP application itself.

Root Cause

The root cause is unsafe deserialization of user-supplied input within Business Central request handling. The application reconstructs .NET objects from serialized streams without enforcing a strict type allowlist. This pattern enables gadget-chain attacks that leverage legitimate classes to execute code during deserialization.

Attack Vector

Exploitation requires network reachability to the Business Central service and any authenticated account. The attacker sends a crafted serialized payload to a vulnerable API or service endpoint. No user interaction is required, and the attack does not require an administrative role. See the Microsoft Security Update CVE-2024-35249 for vendor-provided technical detail. No public proof-of-concept code is available.

Detection Methods for CVE-2024-35249

Indicators of Compromise

Unexpected child processes spawned by Business Central service accounts, particularly cmd.exe, powershell.exe, or w3wp.exe invoking scripting hosts.
Anomalous outbound network connections initiated by the Business Central application server to untrusted destinations.
New or modified DLLs and assemblies within Business Central installation directories that lack a valid Microsoft signature.
Authentication events from low-privilege accounts followed immediately by high-volume API calls to serialization endpoints.

Detection Strategies

Monitor Windows event logs and application logs for deserialization exceptions and stack traces referencing BinaryFormatter or related .NET serializers.
Inspect HTTP request bodies to Business Central endpoints for base64-encoded .NET serialized object signatures such as AAEAAAD/////.
Correlate authenticated Business Central sessions with subsequent process creation events under the application service identity.

Monitoring Recommendations

Baseline normal process ancestry for Business Central services and alert on deviations.
Ingest Business Central and IIS logs into a centralized analytics platform to enable cross-source correlation.
Track privileged and service-account activity for lateral movement following any suspicious authenticated request.

How to Mitigate CVE-2024-35249

Immediate Actions Required

Apply the Microsoft security update for Dynamics 365 Business Central referenced in the MSRC advisory to all affected release waves.
Inventory internet-exposed Business Central instances and restrict access to trusted networks and VPN segments.
Rotate credentials for service and integration accounts if compromise is suspected on an unpatched host.
Review authentication logs for suspicious low-privilege account activity preceding the patch date.

Patch Information

Microsoft addressed CVE-2024-35249 in the June 2024 security update cycle. Refer to the Microsoft Security Update CVE-2024-35249 advisory for the specific build numbers and update packages applicable to each affected release wave. Cloud-hosted Business Central tenants are updated by Microsoft; on-premises deployments require administrator action.

Workarounds

Limit Business Central endpoint exposure to authenticated internal users only until patching completes.
Enforce network segmentation between the Business Central application tier and general user networks.
Disable or restrict any custom extensions that accept serialized input from untrusted sources.

bash

# Example: restrict inbound access to Business Central service ports using Windows Firewall
New-NetFirewallRule -DisplayName "Restrict BC Service" -Direction Inbound -Protocol TCP -LocalPort 7046,7047,7048,7049 -RemoteAddress 10.0.0.0/8 -Action Allow
New-NetFirewallRule -DisplayName "Block BC External" -Direction Inbound -Protocol TCP -LocalPort 7046,7047,7048,7049 -Action Block