Advisory · CVE-2026-102226
Path traversal in Dynamics NAV and Business Central can reach files over the network
Microsoft Dynamics NAV has a path traversal flaw an authorized low-privilege attacker can use over the network to affect files or data. Microsoft rates it CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Microsoft Dynamics NAV
- Identifier / CWE
- CVE-2026-102226
CWE-22 - Action timing
- Immediate
Explain it like I’m five
A low-privilege ERP user can walk file paths out of the folder the application meant to keep them in.
- 01Attacker engages the component
A remote or authorized attacker sends crafted content or requests to Microsoft Dynamics NAV.
- 02Weakness triggers
The component mishandles the input and the flaw takes effect.
- 03Impact lands
The attacker gains the execution, elevation, or access the flaw allows.
What happened
Microsoft disclosed CVE-2026-102226 in its October 2026 update guide: a path traversal weakness (CWE-22) in Microsoft Dynamics NAV / Business Central lets an authorized low-privilege attacker affect files over the network, with a build threshold of 11.0.50736.0 in the affected data seen.
Microsoft lists the affected releases and their patched build thresholds in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Microsoft Dynamics NAV deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Microsoft Dynamics NAV while remediation is underway, especially for internet-facing instances.
- Review application and server logs for traversal strings in Dynamics request logs and files accessed outside application directories.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Pair this with the Dynamics deserialization flaw in the same cycle: one ERP patch window, one file-access audit.