CVE-2026-100214

Summary

A deserialization vulnerability in Dynamics Business Central allows authenticated attackers to execute arbitrary code remotely by crafting malicious serialized data. This represents a critical security flaw since it can be exploited over the network without requiring user interaction.

Exploitability

Exploitation requires an authenticated user account with access to the affected Business Central instance, but is relatively straightforward once achieved as it leverages standard deserialization techniques.

Blast radius

If exploited, this vulnerability could allow attackers to gain full control over the Business Central server, potentially leading to data exfiltration, privilege escalation, and lateral movement within the organization's network.

Detection

Monitor for unusual deserialization activity in application logs and check for suspicious network connections to Business Central endpoints, particularly those involving serialized data transfers.

Prioritized remediation

Apply the latest available security patch or upgrade to Dynamics 365 Business Central version 2024 release wave 2 or later, as this vulnerability was introduced in earlier versions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.