This vulnerability (CVE-2026-40417) affects Microsoft Dynamics 365 Business Central 2024 Release Wave 2 version 25.0. It is classified under CWE-1390 (Weak Authentication). The flaw allows an authorized attacker to elevate privileges locally due to weak authentication mechanisms. The CVSS v3.1 base score is 7.8 with attack vector local, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at the Microsoft Security Response Center.

An authorized attacker with local access can exploit weak authentication to elevate privileges, potentially gaining higher-level access than intended. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. Since the product is a cloud service, the impact is limited to the affected version and environment managed by Microsoft.

Microsoft has released an official fix for this vulnerability and manages remediation for the cloud-hosted Dynamics 365 Business Central service. Customers should ensure their service is updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40417. No additional action is required beyond applying the official fix.