This vulnerability arises from weak authentication handling within Microsoft Dynamics 365 Business Central. An attacker who already holds authorized credentials can exploit the flaw locally to elevate their privileges to a higher level, granting them broader access to system resources and sensitive data. The weakness is identified as CWE-1390 and allows the attacker to override the intended access controls without requiring additional exploitation steps beyond exploiting the authentication logic.

Microsoft Dynamics 365 Business Central is affected in multiple releases: 2024 Release Wave 2, 2025 Release Wave 1, 2025 Release Wave 2, and 2026 Release Wave 1. Users deploying any of these versions on-premises or in cloud environments should verify their installation against the affected product list.

The CVSS score of 7.8 indicates a high severity level for privilege escalation. The EPSS score is not available, so the current probability of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a locally authenticated user; therefore it is a local privilege escalation scenario. The attacker can leverage existing legitimate credentials and the weak authentication flow to gain elevated rights, potentially compromising confidentiality, integrity, and availability of the Business Central instance.