CVE-2026-105727: Path Traversal in Dynamics 365 Business Central Enables Privilege Escalation

What Happened

Microsoft Dynamics 365 Business Central contains a path‑traversal flaw that fails to restrict file name resolution to the designated directory. An authenticated user can supply a crafted path that resolves outside the intended folder, allowing access to system files and potentially elevating privileges over the network.

Impact

Any user with legitimate access to Business Central can exploit the flaw to read or modify files beyond the application boundary, leading to privilege escalation and broader compromise of the underlying host. The vulnerability is exploitable in all current releases of Business Central.

What to Do

• Apply the official security update released by Microsoft for Dynamics 365 Business Central (CVE‑2026‑105727).
• Verify that the application’s file‑system permissions enforce the intended directory boundaries and that no world‑writable directories exist.
• Restrict the set of users with administrative or elevated rights within Business Central and enforce least‑privilege access.
• Enable logging of file‑access events and monitor for anomalous path traversal patterns.

Monitoring & Detection

Set up alerts for attempts to access files outside the Business Central installation directory. Correlate with authentication logs to detect potential exploitation attempts. Review audit trails for unauthorized file modifications.