CVE-2022-41127

highpriority · track · 1EPSS 0.017 · 77 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.71% (77th) EPSS

CVSS 8.5 · high

Is it mine?

68 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedDynamics 365 Business Central 2019 Release Wave 2 (On-Premise)msrc_csaf
App Build 15.17.48428, Platform Build 15.0.48:Security Update:https://support.microsoft.com/en-us/help/5001733
https://support.microsoft.com/en-us/help/5001733
FixedDynamics 365 Business Central Spring 2019 Updatemsrc_csaf
App Build 14.43.49498, Platform Build 14.0.49494:Security Update:https://support.microsoft.com/en-us/help/5021669
https://support.microsoft.com/en-us/help/5021669
FixedMicrosoft Dynamics 365 Business Central 2020 Release Wave 1msrc_csaf
App Build 16.19.35126, Platform Build 16.35120:Security Update:https://support.microsoft.com/en-us/help/5010910
https://support.microsoft.com/en-us/help/5010910
FixedMicrosoft Dynamics 365 Business Central 2020 Release Wave 2msrc_csaf
App Build 17.17.38111, Platform Build 17.0.38061:Security Update:https://support.microsoft.com/en-us/help/5013420
https://support.microsoft.com/en-us/help/5013420
FixedMicrosoft Dynamics 365 Business Central 2021 Release Wave 1msrc_csaf
App Build 18.18.46920, Platform Build 18.0.46905:Security Update:https://support.microsoft.com/en-us/help/5019239
https://support.microsoft.com/en-us/help/5019239
FixedMicrosoft Dynamics 365 Business Central 2021 Release Wave 2msrc_csaf
App Build 19.14.49970, Platform Build 19.0.49925:Security Update:https://support.microsoft.com/en-us/help/5021670
https://support.microsoft.com/en-us/help/5021670
FixedMicrosoft Dynamics 365 Business Central 2022 Release Wave 1msrc_csaf
App Build 20.8.49971, Platform Build 20.0.49947:Security Update:https://support.microsoft.com/en-us/help/5021671
https://support.microsoft.com/en-us/help/5021671
FixedMicrosoft Dynamics 365 Business Central 2022 Release Wave 2msrc_csaf
App Build 21.2.49990, Platform Build 21.0.49984:Security Update:https://support.microsoft.com/en-us/help/5021672
https://support.microsoft.com/en-us/help/5021672
FixedMicrosoft Dynamics NAV 2013 R2msrc_csaf
52297:Security Update:https://support.microsoft.com/en-us/topic/released-cumulative-updates-for-microsoft-dynamics-nav-2013-r2-c7f39bba-e9b2-51ac-5028-0a31b1ed6996
https://support.microsoft.com/en-us/topic/released-cumulative-updates-for-microsoft-dynamics-nav-2013-r2-c7f39bba-e9b2-51ac-5028-0a31b1ed6996
FixedMicrosoft Dynamics NAV 2015msrc_csaf
52204:Security Update:https://Released Cumulative Updates for Microsoft Dynamics NAV 2015 - Microsoft Support
FixedMicrosoft Dynamics NAV 2016msrc_csaf
Build 52203:Security Update:https://support.microsoft.com/en-us/help/5005293
https://support.microsoft.com/en-us/help/5005293
FixedMicrosoft Dynamics NAV 2017msrc_csaf
Build 30712:Security Update:https://support.microsoft.com/en-us/help/5010202
https://support.microsoft.com/en-us/help/5010202
FixedMicrosoft Dynamics NAV 2018msrc_csaf
Build 49497:Security Update:https://support.microsoft.com/en-us/help/5021668
https://support.microsoft.com/en-us/help/5021668

cvss

Technical severity, 0–10. One row per scoring source.

8.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.5highAV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:Csecondary · ENISA EU

v3.18.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · secure@microsoft.com USexploitability 1.8 · impact 6

v3.17.8highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.18.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:Csecondary · Microsoft Security Response Center US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20US

affected products (68)

Products and version ranges known to be affected.

Microsoft Dynamics 365 Business Central 2019 Release Wave 2all versionscert_bundDEcpe:/a:microsoft:dynamics_365:business_central_2019_release_wave_2
Microsoft Dynamics 365 Business Central 2020 Release Wave 1all versionscert_bundDEcpe:/a:microsoft:dynamics_365:business_central_2020_release_wave_1
Microsoft Dynamics 365 Business Central 2020 Release Wave 2all versionscert_bundDEcpe:/a:microsoft:dynamics_365:business_central_2020_release_wave_2
Microsoft Dynamics 365 Business Central 2021 Release Wave 1all versionscert_bundDEcpe:/a:microsoft:dynamics_365:business_central_2021_release_wave_1
Microsoft Dynamics 365 Business Central 2021 Release Wave 2all versionscert_bundDEcpe:/a:microsoft:dynamics_365:business_central_2021_release_wave_2
Microsoft Dynamics 365 Business Central 2022 Release Wave 1all versionscert_bundDEcpe:/a:microsoft:dynamics_365:business_central_2022_release_wave_1
Microsoft Dynamics 365 Business Central 2022 Release Wave 2all versionscert_bundDEcpe:/a:microsoft:dynamics_365:business_central_2022_release_wave_2
Microsoft Dynamics 365 Business Central Spring 2019 Updateall versionscert_bundDEcpe:/a:microsoft:dynamics_365:business_central_spring_2019_update
Microsoft Dynamics NAV 2016all versionscert_bundDEcpe:/a:microsoft:dynamics_nav_2016:-
Microsoft Dynamics NAV 2017all versionscert_bundDEcpe:/a:microsoft:dynamics_nav_2017:-
Microsoft Dynamics NAV 2018all versionscert_bundDEcpe:/a:microsoft:dynamics_nav_2018:-
Microsoft Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)15.0.0 → App Build 15.17.48428, Platform Build 15.0.48enisa_euvdEU
Microsoft Dynamics 365 Business Central Spring 2019 Update14.0.0 → App Build 14.43.49498, Platform Build 14.0.49494enisa_euvdEU
Microsoft Microsoft Dynamics 365 Business Central 2020 Release Wave 116.0.0 → App Build 16.19.35126, Platform Build 16.35120enisa_euvdEU
Microsoft Microsoft Dynamics 365 Business Central 2020 Release Wave 217.0.0 → App Build 17.17.38111, Platform Build 17.0.38061enisa_euvdEU
Microsoft Microsoft Dynamics 365 Business Central 2021 Release Wave 118.0.0 → App Build 18.18.46920, Platform Build 18.0.46905enisa_euvdEU
Microsoft Microsoft Dynamics 365 Business Central 2021 Release Wave 219.0.0 → App Build 19.14.49970, Platform Build 19.0.49925enisa_euvdEU
Microsoft Microsoft Dynamics 365 Business Central 2022 Release Wave 120.0.0 → App Build 20.8.49971, Platform Build 20.0.49947enisa_euvdEU
Microsoft Microsoft Dynamics 365 Business Central 2022 Release Wave 221.0.0 → App Build 21.2.49990, Platform Build 21.0.49984enisa_euvdEU
Microsoft Microsoft Dynamics NAV 2013 R21.0 → 52297enisa_euvdEU

showing 20 of 68

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-2306Microsoft Dynamics: Schwachstelle ermöglichen CodeausführungDeutsch2022-12-13csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Microsoft Dynamics ausnutzen, um beliebigen Programmcode auszuführen.
msrc_CVE-2022-41127Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability2022-12-13csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund msrc_csaf NVD CVE.org MITRE

published 2022-12-13modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan