CVE-2024-43460: Dynamics 365 Business Central Escalation

CVE-2024-43460 Overview

CVE-2024-43460 is an improper authorization vulnerability in Microsoft Dynamics 365 Business Central. The flaw allows an authenticated attacker to elevate privileges over a network. Microsoft assigned the vulnerability a HIGH severity rating with a CVSS 3.1 score of 8.8. The weakness maps to [CWE-285] Improper Authorization.

An attacker with low-privileged access to the application can abuse missing or incomplete authorization checks to perform actions reserved for higher-privileged roles. Successful exploitation impacts confidentiality, integrity, and availability of the Business Central environment.

Critical Impact
An authenticated low-privileged user can escalate to higher-privileged roles within Dynamics 365 Business Central and gain full read, write, and administrative control over business data.

Affected Products

Microsoft Dynamics 365 Business Central (online)
Microsoft Dynamics 365 Business Central (on-premises)
Dynamics 365 Business Central deployments prior to the September 2024 security update

Discovery Timeline

2024-09-17 - CVE-2024-43460 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in the NVD database

Technical Details for CVE-2024-43460

Vulnerability Analysis

CVE-2024-43460 is an authorization flaw within Dynamics 365 Business Central. Business Central is Microsoft's cloud-based enterprise resource planning (ERP) product used for finance, sales, service, and operations. The vulnerability arises because the application does not correctly enforce authorization checks on privileged operations. An authenticated user can invoke functionality that should be gated behind a higher role.

The attack vector is network-based, requires low privileges, and needs no user interaction. Exploitation is straightforward for any user with valid application credentials. The impact spans confidentiality, integrity, and availability because Business Central stores financial records, vendor data, and business workflows.

At the time of writing, no public proof-of-concept exploit is available, and CISA has not added the issue to the Known Exploited Vulnerabilities (KEV) catalog. Microsoft has not disclosed the specific module or endpoint containing the missing authorization check.

Root Cause

The root cause is improper authorization [CWE-285]. Business Central grants access to a resource or operation without validating that the calling user holds the required permission set. Role-based access control is enforced inconsistently across the affected code path, allowing a lower-privileged principal to invoke privileged logic.

Attack Vector

An attacker authenticates to Dynamics 365 Business Central using a standard user account. The attacker then sends a network request targeting a privileged operation, page, or API endpoint that lacks correct authorization enforcement. Because the missing check is server-side, the attacker does not need to bypass client-side controls. The result is elevation of privilege inside the Business Central tenant or on-premises deployment.

See the Microsoft Security Update Guide for vendor-specific technical details.

Detection Methods for CVE-2024-43460

Indicators of Compromise

Standard user accounts performing administrative actions such as permission set modifications, user role changes, or company setup changes
API or web service calls from low-privileged sessions that succeed against endpoints reserved for privileged roles
Unexpected changes to financial records, vendor bank details, or approval workflow configurations
Creation of new users or elevation of existing users initiated by accounts that historically only performed read operations

Detection Strategies

Correlate Business Central telemetry with authentication logs from Microsoft Entra ID to identify sessions where role assignment does not match the actions performed.
Baseline normal permission set usage per user and alert on deviations, particularly access to SUPER, security, or setup-related permission sets.
Monitor Business Central audit trails for changes to User, User Permission Set, and Permission Set tables initiated by non-administrative accounts.

Monitoring Recommendations

Forward Dynamics 365 Business Central telemetry and Microsoft Entra ID sign-in logs into a centralized data lake for cross-source correlation.
Enable Change Log within Business Central for sensitive tables and retain logs for the duration required by your incident response policy.
Alert on service-to-service and web service API calls that invoke privileged codeunits from non-administrator OAuth tokens.

How to Mitigate CVE-2024-43460

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Business Central environments.
Inventory all Business Central tenants and on-premises deployments and confirm the patch level of each.
Review recent audit logs for signs of unauthorized privilege changes performed since the CVE publication date.
Rotate credentials and API keys for any account observed performing anomalous privileged actions.

Patch Information

Microsoft released a security update addressing CVE-2024-43460 as part of the September 2024 Patch Tuesday cycle. Cloud tenants are updated automatically by Microsoft. On-premises administrators must install the corresponding cumulative update for their Business Central version. Refer to the Microsoft Security Update Guide for the exact build numbers and download links.

Workarounds

Enforce least privilege by auditing all custom and built-in permission sets and removing unnecessary access from standard user roles.
Restrict Business Central web service and API access to trusted networks using conditional access policies in Microsoft Entra ID.
Require multi-factor authentication for all Business Central users to raise the cost of credential compromise, which is a precondition for exploitation.
Disable or restrict any custom extensions that expose privileged codeunits to non-administrative users until the patch is applied.

bash

# Configuration example: verify Business Central on-premises patch level via PowerShell
Get-NAVServerInstance | Select-Object ServerInstance, Version, State

# Review users assigned the SUPER permission set
Get-NAVServerUser -ServerInstance BC240 | Where-Object { $_.PermissionSets -contains 'SUPER' }