PatchTheCVECVE-2026-40375: Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over
42
This month
MEDIUM 6.5WATCHLISTDOWNGRADEUPGRADEUPGRADE
CVE-2026-40375 is a medium-severity flaw (CVSS 6.5) affecting dynamics 365 business central 2024, dynamics 365 business central 2025, dynamics 365 business central 2026. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 42%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2026-08-11 |
| Last modified | 2026-08-13 |
Publisher (CNA): Microsoft Corporation · Vendor: microsoft
Last updated 2026-08-13 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
microsoft dynamics 365 business central 2024 DOWNGRADE
Affected: >= 25.1.25900
Fixed in: no fixed release known
Safe to downgrade to: a release before 25.1.25900
1. Check installed version
apt-cache policy dynamics-365-business-central-2024 || rpm -q dynamics-365-business-central-2024 || dynamics-365-business-central-2024 --version
2. No fixed release: DOWNGRADE to a release before 25.1.25900 (Debian / Ubuntu)
apt-cache madison dynamics-365-business-central-2024
sudo apt install dynamics-365-business-central-2024=<VERSION_BEFORE_25.1.25900>
sudo apt-mark hold dynamics-365-business-central-2024
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list dynamics-365-business-central-2024
sudo dnf downgrade dynamics-365-business-central-2024-<VERSION_BEFORE_25.1.25900>
sudo dnf versionlock add dynamics-365-business-central-2024
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft dynamics 365 business central 2025 UPGRADE
Affected: >= 26.0 and < 26.0.50788 · >= 27.0 and < 27.0.50789
Fixed in: 26.0.50788, 27.0.50789
Safe to downgrade to: a release before 26.0
1. Check installed version
apt-cache policy dynamics-365-business-central-2025 || rpm -q dynamics-365-business-central-2025 || dynamics-365-business-central-2025 --version
2. UPGRADE to 26.0.50788 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade dynamics-365-business-central-2025
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade dynamics-365-business-central-2025
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 26.0 (Debian / Ubuntu)
apt-cache madison dynamics-365-business-central-2025
sudo apt install dynamics-365-business-central-2025=<VERSION_BEFORE_26.0>
sudo apt-mark hold dynamics-365-business-central-2025
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list dynamics-365-business-central-2025
sudo dnf downgrade dynamics-365-business-central-2025-<VERSION_BEFORE_26.0>
sudo dnf versionlock add dynamics-365-business-central-2025
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft dynamics 365 business central 2026 UPGRADE
Affected: >= 28.0 and < 28.0.50938
Fixed in: 28.0.50938
Safe to downgrade to: a release before 28.0
1. Check installed version
apt-cache policy dynamics-365-business-central-2026 || rpm -q dynamics-365-business-central-2026 || dynamics-365-business-central-2026 --version
2. UPGRADE to 28.0.50938 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade dynamics-365-business-central-2026
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade dynamics-365-business-central-2026
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 28.0 (Debian / Ubuntu)
apt-cache madison dynamics-365-business-central-2026
sudo apt install dynamics-365-business-central-2026=<VERSION_BEFORE_28.0>
sudo apt-mark hold dynamics-365-business-central-2026
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list dynamics-365-business-central-2026
sudo dnf downgrade dynamics-365-business-central-2026-<VERSION_BEFORE_28.0>
sudo dnf versionlock add dynamics-365-business-central-2026
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-40375?
dynamics 365 business central 2024: downgrade or apply the listed mitigation; dynamics 365 business central 2025: upgrade to 26.0.50788, 27.0.50789; dynamics 365 business central 2026: upgrade to 28.0.50938. Exact commands for each OS are on this page.
Is CVE-2026-40375 being exploited?
CVE-2026-40375 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-40375 affect?
CVE-2026-40375 affects dynamics 365 business central 2024, dynamics 365 business central 2025, dynamics 365 business central 2026. Severity is medium (CVSS 6.5). Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.
How urgent is CVE-2026-40375?
Priority 42/100. On your watchlist