Advisory · CVE-2026-100214
Deserialization flaw in Dynamics NAV and Business Central can run code
Microsoft Dynamics NAV 2017 and 2018 (Business Central's predecessors) deserialize untrusted data in a way an authorized low-privilege attacker can use to execute code over the network. Microsoft rates it CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Microsoft Dynamics NAV
- Identifier / CWE
- CVE-2026-100214
CWE-502 - Action timing
- Immediate
Explain it like I’m five
The ERP server rebuilds objects from data an attacker supplies, and a rigged object rebuilds itself into running code.
- 01Attacker engages the component
A remote or authorized attacker sends crafted content or requests to Microsoft Dynamics NAV.
- 02Weakness triggers
The component mishandles the input and the flaw takes effect.
- 03Impact lands
The attacker gains the execution, elevation, or access the flaw allows.
What happened
Microsoft disclosed CVE-2026-100214 in its October 2026 update guide: deserialization of untrusted data (CWE-502) in Microsoft Dynamics NAV 2017 and 2018 lets an authorized attacker execute code over the network. Microsoft’s affected data gives build thresholds of 30713 for NAV 2017 and 11.0.50736.0 for NAV 2018.
Microsoft lists the affected releases and their patched build thresholds in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Microsoft Dynamics NAV deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Microsoft Dynamics NAV while remediation is underway, especially for internet-facing instances.
- Review application and server logs for deserialization errors in Dynamics logs and code execution under the service account.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
ERP servers hold the money data. An authorized-user code execution flaw there is a patch-and-audit item, especially for dormant low-privilege accounts.