CVE-2026-105727

Summary

This CVE describes a path traversal vulnerability in Dynamics Business Central that allows authenticated attackers to escape restricted directories and potentially elevate privileges across the network. The flaw stems from improper limitation of file paths, enabling attackers to access unauthorized resources.

Exploitability

Exploitation requires an authenticated user account with access to Business Central, making it moderately difficult but achievable through social engineering or credential compromise, with no additional preconditions beyond initial access.

Blast radius

If exploited, this vulnerability could allow attackers to gain elevated privileges across the entire Dynamics Business Central environment, potentially leading to unauthorized data access, modification, or system compromise affecting multiple users and business processes.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version is published in the description; disable the affected file path traversal functionality or restrict access to Business Central endpoints that handle file operations until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.