CVE-2026-102226
HighCVSS 8.8Summary
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
Risk Assessment
An attacker with valid credentials could exploit this vulnerability to gain higher privileges, potentially leading to unauthorized access to data and application functions.
Recommendation
Install available security updates for Dynamics Business Central as soon as possible and restrict network access to the minimum necessary.
Other vulnerabilities in Dynamics Business Central
See all- CVE-2026-105728High
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
- CVE-2026-105727High
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
- CVE-2026-100214High
Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.
- CVE-2026-40375Medium
Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.
- CVE-2025-29821Medium
A vulnerability in Dynamics Business Central is due to improper input validation, allowing an authorized attacker to disclose information locally.
Original NVD description (English source)
Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS