CVE-2026-105727: Dynamics NAV 2018 Path Traversal Elevation of Privilege Fix

Published on October 13, 2026 (after being reserved on October 5, 2026), the vulnerability carries a CVSS v3.1 Base Score of 8.8 (High). According to Microsoft's official CVE record and the OpenCVE vulnerability database, the issue stems from a path traversal weakness that allows an authorized attacker to elevate their privileges over a network. While the vulnerability's title references Dynamics 365 Business Central, the structured product metadata specifically flags Microsoft Dynamics NAV 2018 deployments running versions below 11.0.50736.0.

For Windows Server administrators and ERP managers maintaining legacy or hybrid business applications, understanding the exact boundaries of this advisory—what is confirmed in the public record and what remains unspecified—is essential for accurate patch triage.

The Technical Anatomy of CVE-2026-105727​

At the core of CVE-2026-105727 is a classic software weakness categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). As stated in Microsoft's Security Update Guide summary and the published CVE record, improper limitation of a pathname to a restricted directory in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.

In general software security terms, CWE-22 occurs when an application accepts user-controlled input to construct a file or directory path without properly neutralizing special elements like .. (dot-dot-slash) sequences. When a service fails to strictly lock file operations inside an intended directory, a user may be able to step outside that restricted folder to read, overwrite, or interact with sensitive configuration files or binaries elsewhere on the system.

However, it is important for administrators to note the limits of the public disclosure. Microsoft's published CVE entry does not identify the exact vulnerable endpoint, the specific file operation involved, the step-by-step exploit mechanics, or the exact privilege tier an attacker achieves upon successful exploitation. Security teams must base their risk assessments on the published severity metrics and version thresholds rather than assuming a specific attack path.

Summary of Key Vulnerability Metadata​

Section Summary: CVE-2026-105727 is a network-accessible path traversal flaw (CWE-22) rated 8.8 High. While the root weakness class is confirmed, Microsoft has not publicly disclosed the specific endpoint or exploit mechanics.

Navigating the Naming Dualism: Business Central vs. Dynamics NAV 2018​

If you look closely at the CVE record stored in MITRE and indexed by OpenCVE, an immediate naming discrepancy jumps out. The official title and text description refer to Microsoft Dynamics 365 Business Central, whereas the affected product configuration table and Common Platform Enumeration (CPE) strings explicitly list Microsoft Dynamics NAV 2018 (cpe:2.3:a:microsoft:dynamics_nav_2018).

Why are both names attached to the same vulnerability? Industry veterans who have managed Microsoft's ERP lineup know that Dynamics 365 Business Central evolved directly from the Dynamics NAV codebase. Even so, when conducting a security audit, administrators must stick strictly to what the record establishes rather than making broad assumptions:

• The Stated Version Boundary: The CVE record marks Microsoft Dynamics NAV 2018 versions starting from 1.0 up to, but not including, 11.0.50736.0 as affected. (Build 11.0 is the standard internal version numbering family for Dynamics NAV 2018).
• The Platform Listing: The structured affected-product metadata lists Windows Server 2012 under its platform field.
• Why Dynamics NAV 2018 Still Matters in 2026: Some newer administrators might wonder why a 2018-era product is receiving high-severity CVE tracking in late 2026. According to Microsoft Learn's official product lifecycle documentation, Dynamics NAV 2018 launched on December 1, 2017, reached the end of Mainstream Support on January 11, 2023, and remains in Extended Support until January 12, 2028. During Extended Support, Microsoft continues to provide security updates for supported installations.

Because the public CVE metadata associates both the Business Central title and the Dynamics NAV 2018 product identifier with this flaw without detailing how other deployments might relate, administrators should not assume that every modern cloud or on-premises Business Central instance is affected—nor should they ignore NAV 2018 servers thinking the title only applies to newer branding. Treat 11.0.50736.0 as the stated version cutoff in the CVE record, and verify your specific deployment against Microsoft's live Security Update Guide portal.

Section Summary: The advisory title names Dynamics 365 Business Central, while the affected-product metadata specifies Microsoft Dynamics NAV 2018 versions prior to 11.0.50736.0 on Windows Server 2012. Dynamics NAV 2018 remains under Microsoft Extended Support through January 2028.

Decoding the CVSS 8.8 Vector and Confidence Metrics​

To understand why this elevation of privilege bug warrants an 8.8 High score, we can break down its full CVSS v3.1 vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

According to the Forum of Incident Response and Security Teams (FIRST) CVSS v3.1 specification, these metrics translate into practical operational insights for defenders:

1. Attack Vector: Network (AV:N): The vulnerable component is bound to the network stack. An attacker does not need local console access to the Windows Server hosting the ERP instance; the attack can be sent across an internal corporate intranet or over a wide-area network if the service is exposed.
2. Attack Complexity: Low (AC:L): Exploitation does not depend on measurable preparation or winning race conditions. If the target is running an affected version and the attacker meets the privilege prerequisite, the attack can be executed reliably.
3. Privileges Required: Low (PR:L): Crucially, this is not an unauthenticated vulnerability. The attacker must already possess basic user-level credentials or low-level access to the application before they can trigger the path traversal flaw.
4. User Interaction: None (UI:N): The attacker does not need to trick an administrator or another user into clicking a link or opening a file.
5. Scope: Unchanged (S:U): The exploited vulnerability affects resources managed by the same security authority as the vulnerable component itself.
6. Confidentiality, Integrity, and Availability Impacts: High (C:H/I:H/A:H): Within that unchanged security scope, successful elevation of privilege grants total or serious impact across all three pillars—allowing the attacker to view restricted data, modify protected files or records, and potentially disrupt service availability.

Temporal Metrics: Report Confidence vs. Exploit Maturity​

Microsoft Security Update Guide pages often display boilerplate definitions explaining CVSS metrics, such as Report Confidence (RC) and Attack Complexity. In the vector string for CVE-2026-105727, Microsoft includes three important Temporal metrics:

• Report Confidence: Confirmed (RC:C): Under the FIRST CVSS v3.1 specification, this metric measures the degree of confidence in the existence of the vulnerability and the credibility of its known technical details. A rating of Confirmed indicates that the vendor of the affected technology (Microsoft) has acknowledged and verified the presence of the vulnerability.
• Remediation Level: Official Fix (RL:O): Indicates that a complete vendor solution or upgrade path is recorded as available.
• Exploit Code Maturity: Unproven (E:U): Indicates that no functional or proof-of-concept exploit code is publicly available to the vendor's knowledge at the time of scoring.

Complementing these CVSS metrics, the Cybersecurity and Infrastructure Security Agency (CISA) Authorized Data Publisher (ADP) enrichment program evaluated CVE-2026-105727 using the Stakeholder-Specific Vulnerability Categorization (SSVC) framework on October 13, 2026. CISA's SSVC assessment records Exploitation: none, Automatable: no, and Technical Impact: total. Furthermore, as of October 14, 2026, the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and holds no EPSS score.

While the absence of active exploitation and public exploit code is reassuring, FIRST guidelines emphasize that temporal status indicators can change over time and do not negate the intrinsic 8.8 Base Score.

Section Summary: The 8.8 score reflects a low-complexity, network-reachable flaw that requires low-level user privileges (PR:L) and requires no user interaction. While vendor-confirmed (RC:C), there is currently no recorded active exploitation (E:U, SSVC Exploitation: none).

Practical Triage Guide for ERP and Windows Administrators​

Because the public CVE feed does not bundle a standalone patch installer, direct download link, or KB number within the raw JSON record, administrators should take a methodical approach to verifying their environment:

1. Inventory Dynamics NAV and Business Central Installations: Audit your Windows Server infrastructure—paying particular attention to legacy servers including Windows Server 2012—for any installed instances of Microsoft Dynamics NAV 2018 or on-premises Dynamics 365 Business Central components.
2. Check Installed Build Numbers: Compare your running application and platform build numbers against the affected range noted in the CVE record (1.0 up to, but excluding, 11.0.50736.0).
3. Consult the Live MSRC Advisory for Patch Packages: Open the CVE-2026-105727 entry directly inside a JavaScript-enabled browser on the Microsoft Security Update Guide portal to obtain the exact cumulative update package, KB reference, and official deployment instructions for your specific locale and deployment topology.
4. Review Network Exposure and User Accounts: Because the attack vector is network-based (AV:N) and requires an authorized user (PR:L), ensure that your ERP web clients and service tiers are not unnecessarily exposed to the public internet. Audit active user accounts inside Dynamics to ensure former employees, contractors, or unused service accounts are disabled, minimizing the pool of credentials an attacker could use as a stepping stone.

By combining strict version inventory with network access controls, enterprise IT teams can neutralize the risk of privilege escalation across their financial and operational systems before opportunistic attackers ever get a foothold.