The vulnerability stems from an improper authentication mechanism in Dynamics Business Central that permits an unauthorized user to read sensitive data over the network. This flaw results in a confidentiality breach, allowing attackers to obtain information that should only be available to authenticated users. The weakness is classified as CWE-306.

Microsoft Dynamics NAV 2018, also referred to as Dynamics Business Central. The CNA data lists Microsoft:Microsoft Dynamics NAV 2018 as the affected product, but no further version details are specified, so any deployment of that product is potentially vulnerable.

The CVSS score of 7.5 indicates high risk, yet no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, implying limited evidence of real‑world exploitation. The attack vector is inferred to be remote, as the disclosure occurs over a network and requires the attacker to reach the system's authentication endpoint. Successful exploitation would expose confidential data without altering the system state.