Deserialization of untrusted data within Microsoft Dynamics Business Central enables an authorized attacker to execute arbitrary code over a network, resulting in full compromise of the affected system. The vulnerability, classified as CWE-502, can lead to loss of confidentiality, integrity, and availability of the targeted data and services.

Microsoft Dynamics NAV 2017 and Microsoft Dynamics NAV 2018 are affected. No additional vendor or product versions are listed.

The CVSS score of 8.8 indicates high severity, and the EPSS score of 2% indicates a low yet non-zero probability of exploitation. The lack of a known KEV listing does not diminish the potential for exploitation by attackers who already have authorized network access. Attackers would need valid credentials or privileged access on the network to exploit the deserialization flaw, which could then be leveraged to execute code with the privileges of the authenticated user.