CVE-2026-40375: Dynamics 365 Information Disclosure Flaw

CVE-2026-40375 Overview

CVE-2026-40375 is a missing authorization vulnerability [CWE-862] affecting Microsoft Dynamics 365 Business Central. The flaw allows an authenticated attacker to disclose sensitive information over a network by accessing resources that should be restricted. Microsoft rates the issue as medium severity with a CVSS 3.1 score of 6.5.

The vulnerability affects the on-premise deployments of Dynamics 365 Business Central versions 2024, 2025, and 2026. Exploitation requires low-privilege network access but no user interaction, making it accessible to any authenticated user within the environment. Successful exploitation results in confidentiality impact without compromising integrity or availability.

Critical Impact
Authenticated attackers can read confidential business data such as financial records, customer information, and internal configuration exposed by improperly protected endpoints in Dynamics 365 Business Central.

Affected Products

Microsoft Dynamics 365 Business Central 2024 (on-premise)
Microsoft Dynamics 365 Business Central 2025 (on-premise)
Microsoft Dynamics 365 Business Central 2026 (on-premise)

Discovery Timeline

2026-08-11 - CVE-2026-40375 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-40375

Vulnerability Analysis

The vulnerability is a missing authorization weakness classified under [CWE-862]. Dynamics 365 Business Central exposes functionality or data endpoints without verifying that the requesting user has the privileges required to access the underlying resources. An authenticated user with limited application permissions can therefore retrieve information intended for higher-privileged roles.

Because Business Central serves as an enterprise resource planning (ERP) system, the exposed information may include ledger entries, vendor and customer records, employee data, and configuration parameters. The impact is limited to confidentiality; the attacker cannot modify data or disrupt service through this flaw alone.

Root Cause

The root cause is an authorization check omitted or inadequately enforced on one or more application-tier operations. Business Central relies on permission sets to gate access to tables, pages, and web services. When an operation reaches its handler without validating the caller's effective permissions, the server returns data that the caller should not see.

Attack Vector

Exploitation occurs over the network against a Business Central service endpoint. The attacker must hold valid credentials for the tenant or on-premise instance. From an authenticated session, the attacker issues crafted requests to the vulnerable operation and receives protected data in the response. No user interaction and no elevated privileges are required.

Microsoft has not published proof-of-concept details, and no public exploit is available. Refer to the Microsoft Security Update for CVE-2026-40375 for vendor guidance.

Detection Methods for CVE-2026-40375

Indicators of Compromise

Unexpected read operations from low-privileged Business Central accounts against pages, tables, or web services associated with sensitive modules such as General Ledger, Vendor, or Customer.
Bulk data retrieval patterns from a single authenticated user session over short time windows.
Access to OData or SOAP endpoints from user accounts that historically do not consume the API.

Detection Strategies

Enable Business Central change log and telemetry export to a centralized logging platform, then baseline normal per-user access patterns to surface deviations.
Correlate authentication events with API access logs to identify accounts querying resources outside their business role.
Alert on repeated authorization decisions where a user retrieves records from tables not present in their assigned permission sets.

Monitoring Recommendations

Forward Business Central Application Insights telemetry and IIS logs to a SIEM for continuous review.
Monitor for anomalous volumes of GET requests to /BC/ODataV4/ and /BC/WS/ endpoints.
Track privilege changes and new account creation in the Business Central user list to detect adversary preparation.

How to Mitigate CVE-2026-40375

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Response Center advisory for each affected Business Central version.
Inventory all on-premise Business Central deployments including 2024, 2025, and 2026 releases and confirm patch status.
Review user permission sets and remove access from accounts that do not require it, applying least privilege.

Patch Information

Microsoft has released security updates for Dynamics 365 Business Central 2024, 2025, and 2026 on-premise editions. Administrators should download and deploy the applicable cumulative update from the Microsoft Security Update Guide. Cloud-hosted Business Central environments are updated by Microsoft.

Workarounds

Restrict network access to Business Central service tier endpoints using firewall rules or VPN gating so only trusted clients can authenticate.
Audit and tighten permission sets, removing broad SUPER or wide-scope assignments from non-administrative users.
Disable unused web services and OData endpoints in the Business Central administration console to reduce the exposed surface.

bash

# Configuration example: list and disable unused Business Central web services via PowerShell
Get-NAVServerSession -ServerInstance BC260
Get-NAVWebService -ServerInstance BC260 | Where-Object { $_.Published -eq $true }
Set-NAVWebService -ServerInstance BC260 -ServiceType Codeunit -ServiceName "UnusedService" -Published $false