What is CVE-2026-40417?

CVE-2026-40417 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Which CVE IDs does CVE-2026-40417 cover?

CVE-2026-40417 covers the following CVE IDs: CVE-2026-40417. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2026-40417?

CVE-2026-40417 has a CVSS v3 base score of 7.8, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2026-40417?

CVE-2026-40417 affects 4 products, including: Microsoft Dynamics 365 Business Central 2024 Release Wave 2; Microsoft Dynamics 365 Business Central 2026 Release Wave 1; Microsoft Dynamics 365 Business Central Release Wave 1 2025; Microsoft Dynamics 365 Business Central Release Wave 2 2025.

CVE-2026-40417HighCVSS 7.8

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

May 22, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-40417 →

📋 Description

Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.

🎯 Affected products4

Microsoft Dynamics 365 Business Central 2024 Release Wave 2
Microsoft Dynamics 365 Business Central 2026 Release Wave 1
Microsoft Dynamics 365 Business Central Release Wave 1 2025
Microsoft Dynamics 365 Business Central Release Wave 2 2025

✅ Remediation

KB5093780 (Security Update) — fixed build 28.0.49873 KB5086069 (Security Update) — fixed build 26.0.48120 KB5086070 (Security Update) — fixed build 27.0.48102 KB5086068 (Security Update) — fixed build 25.2.48119

🔗 References (9)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40417
patchhttps://support.microsoft.com/en-us/topic/update-28-1-for-microsoft-dynamics-365-business-central-2026-release-wave-1-application-build-28-1-49886-platform-build-28-0-49873-fdf9d853-6477-4413-9d72-4fd762c7eeaf
referencehttp://support.microsoft.com/kb/5093780
patchhttps://support.microsoft.com/en-us/topic/update-26-12-for-microsoft-dynamics-365-business-central-2025-release-wave-1-application-build-26-12-48244-platform-build-26-0-48120-03fdc340-6d17-4a0c-9c0b-832e5bbd4c0c
referencehttp://support.microsoft.com/kb/5086069
patchhttps://support.microsoft.com/en-us/topic/update-27-6-for-microsoft-dynamics-365-business-central-2025-release-wave-2-application-build-27-6-48260-platform-build-27-0-48102-e210498d-346d-4435-b2de-388206225d67
referencehttp://support.microsoft.com/kb/5086070
patchhttps://support.microsoft.com/en-us/topic/update-25-18-for-microsoft-dynamics-365-business-central-2024-release-wave-2-application-build-25-18-48229-platform-build-25-2-48119-e2f0099d-035b-44aa-8762-d31e4cc99a09
referencehttp://support.microsoft.com/kb/5086068