Skip to content
Fencer Vulns
high 8.5

CVE-2022-41127 json

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

published 2022-12-13 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-44370

cvss
8.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits
0
none known

Summary

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Patch / fix

  • Microsoft Microsoft Dynamics NAV 2016 Build 52203
  • Microsoft Microsoft Dynamics NAV 2017 Build 30712
  • Microsoft Microsoft Dynamics NAV 2018 Build 49497
  • Microsoft Microsoft Dynamics NAV 2015 52204
  • Microsoft Dynamics 365 Business Central Spring 2019 Update App Build 14.43.49498, Platform Build 14.0.49494
  • Microsoft Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) App Build 15.17.48428, Platform Build 15.0.48
  • Microsoft Microsoft Dynamics 365 Business Central 2020 Release Wave 2 App Build 17.17.38111, Platform Build 17.0.38061
  • Microsoft Microsoft Dynamics 365 Business Central 2020 Release Wave 1 App Build 16.19.35126, Platform Build 16.35120
  • Microsoft Microsoft Dynamics 365 Business Central 2022 Release Wave 1 App Build 20.8.49971, Platform Build 20.0.49947
  • Microsoft Microsoft Dynamics 365 Business Central 2021 Release Wave 2 App Build 19.14.49970, Platform Build 19.0.49925
  • Microsoft Microsoft Dynamics 365 Business Central 2022 Release Wave 2 App Build 21.2.49990, Platform Build 21.0.49984
  • Microsoft Microsoft Dynamics 365 Business Central 2021 Release Wave 1 App Build 18.18.46920, Platform Build 18.0.46905
  • Microsoft Microsoft Dynamics NAV 2013 R2 52297

Exploit prediction

1.71% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA 3.1 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Microsoft Microsoft Dynamics NAV 2016
  • Microsoft Microsoft Dynamics NAV 2017
  • Microsoft Microsoft Dynamics NAV 2018
  • Microsoft Microsoft Dynamics NAV 2015
  • Microsoft Dynamics 365 Business Central Spring 2019 Update
  • Microsoft Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)
  • Microsoft Microsoft Dynamics 365 Business Central 2020 Release Wave 2
  • Microsoft Microsoft Dynamics 365 Business Central 2020 Release Wave 1
  • Microsoft Microsoft Dynamics 365 Business Central 2022 Release Wave 1
  • Microsoft Microsoft Dynamics 365 Business Central 2021 Release Wave 2
  • Microsoft Microsoft Dynamics 365 Business Central 2022 Release Wave 2
  • Microsoft Microsoft Dynamics 365 Business Central 2021 Release Wave 1
  • Microsoft Microsoft Dynamics NAV 2013 R2

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.