CVE-2026-55944: Microsoft Dynamics NAV RCE Vulnerability

CVE-2026-55944 Overview

CVE-2026-55944 is a critical deserialization vulnerability in Microsoft Dynamics NAV that allows unauthenticated attackers to execute arbitrary code over a network. The flaw is categorized under [CWE-502] (Deserialization of Untrusted Data) and carries a CVSS 3.1 base score of 9.8. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) on July 14, 2026. Because the vulnerability requires no privileges and no user interaction, attackers can reach vulnerable Dynamics NAV instances directly across the network and gain full compromise of confidentiality, integrity, and availability.

Critical Impact
An unauthenticated remote attacker can execute arbitrary code on affected Microsoft Dynamics NAV servers, resulting in full system compromise.

Affected Products

Microsoft Dynamics NAV (see the Microsoft Vulnerability CVE-2026-55944 advisory for specific supported versions)

Discovery Timeline

2026-07-14 - CVE CVE-2026-55944 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-55944

Vulnerability Analysis

The vulnerability stems from insecure deserialization within Microsoft Dynamics NAV. Dynamics NAV accepts serialized objects from a network-facing interface and reconstructs them without validating their type or contents. During deserialization, .NET binary formatters can instantiate arbitrary classes and invoke methods such as constructors and property setters. Attackers craft serialized payloads that trigger gadget chains during object reconstruction, leading to arbitrary code execution in the context of the Dynamics NAV service account.

Dynamics NAV service accounts typically run with elevated privileges on the host and hold direct access to the underlying SQL database. Successful exploitation therefore grants attackers a foothold with access to enterprise resource planning (ERP) data, financial records, and downstream integrations. The lack of authentication requirements means the vulnerability can be reached by any client with network access to the exposed Dynamics NAV service endpoint.

Root Cause

The root cause is the application's use of an unsafe deserialization routine on data received from untrusted network sources. The affected code path does not enforce a type allowlist, does not verify payload integrity, and does not restrict which assemblies can be resolved during reconstruction. This aligns with the [CWE-502] pattern seen across .NET deserialization flaws, including known gadget chains involving BinaryFormatter, NetDataContractSerializer, LosFormatter, and similar serializers.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker sends a crafted serialized payload to a network-reachable Dynamics NAV endpoint. The service deserializes the payload and executes attacker-controlled logic during object reconstruction. No preconditions beyond network reachability are required, which explains the CVSS attack complexity rating of Low.

No verified public proof-of-concept exploit is available at the time of publication. The EPSS (Exploit Prediction Scoring System) probability is 1.309% with a percentile of 67.4, indicating measurable but not yet widespread exploitation likelihood. Refer to the Microsoft Vulnerability CVE-2026-55944 advisory for authoritative technical details.

Detection Methods for CVE-2026-55944

Indicators of Compromise

Unexpected child processes spawned by the Dynamics NAV service host process, especially cmd.exe, powershell.exe, or script interpreters.
Outbound network connections initiated by the Dynamics NAV service to unfamiliar external IP addresses shortly after inbound requests to service endpoints.
New scheduled tasks, services, or persistence artifacts created under the Dynamics NAV service account.
Deserialization exceptions or unusual BinaryFormatter, SoapFormatter, or NetDataContractSerializer error entries in Dynamics NAV application logs.

Detection Strategies

Monitor process lineage for the Dynamics NAV service and alert on any child process creation that is not part of normal ERP operations.
Inspect network traffic to Dynamics NAV service ports for anomalously large serialized payloads or requests containing serialized .NET type markers such as TypeObject, BinaryFormatter headers, or base64-encoded assembly references.
Correlate authentication logs with process telemetry to identify unauthenticated sessions that precede code execution events.

Monitoring Recommendations

Enable Windows command-line auditing and PowerShell script block logging on servers hosting Dynamics NAV.
Forward endpoint, application, and network telemetry to a centralized analytics platform for cross-source correlation and retention.
Baseline normal Dynamics NAV behavior so deviations in outbound connections, file writes, and registry modifications trigger investigation.

How to Mitigate CVE-2026-55944

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Vulnerability CVE-2026-55944 advisory as soon as possible.
Inventory all Dynamics NAV instances, including test and legacy environments, and prioritize internet-exposed servers for immediate remediation.
Restrict network access to Dynamics NAV service endpoints to trusted management networks and authenticated clients only.
Review Dynamics NAV service accounts and reduce their privileges where operationally feasible.

Patch Information

Microsoft has released a security update addressing CVE-2026-55944. Consult the Microsoft Vulnerability CVE-2026-55944 advisory for the specific update packages, supported version matrix, and installation guidance. Apply the patch through standard Windows Update, Windows Server Update Services (WSUS), or your enterprise patch management workflow.

Workarounds

Block inbound traffic to Dynamics NAV service ports from untrusted networks using host-based and perimeter firewalls until patching is complete.
Place Dynamics NAV servers behind an authenticated reverse proxy or VPN concentrator to prevent unauthenticated network reach.
Disable or isolate any Dynamics NAV endpoints that are not required for business operations.

bash

# Example: restrict inbound access to the Dynamics NAV service port to a trusted management subnet
New-NetFirewallRule -DisplayName "Restrict Dynamics NAV Service" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 7046 `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "Block Dynamics NAV Service - Default Deny" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 7046 `
  -Action Block