This vulnerability (CVE-2026-40417) in Microsoft Dynamics 365 Business Central 2024 Release Wave 2 is classified under CWE-1390 (Weak Authentication). It allows an attacker who already has some level of authorized local access to escalate their privileges, potentially gaining higher-level permissions. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality, integrity, and availability. Microsoft manages this as a cloud service and has released an official fix to address the issue.

An authorized attacker with local access to the affected Microsoft Dynamics 365 Business Central environment can exploit weak authentication mechanisms to elevate privileges. This can lead to full compromise of the system's confidentiality, integrity, and availability. Since the product is a cloud service, the impact is relevant to customers using the affected version 25.0 of the service.

Microsoft has released an official fix for this vulnerability. As this is a cloud-hosted service, Microsoft manages the remediation on the server side. Customers should verify that their service instances are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40417 to ensure the vulnerability is mitigated.