CVE-2026-40375 Microsoft CVE debrief

Who should care

Defenders responsible for Microsoft Dynamics 365 Business Central deployments should assess exposure and prioritize patching affected versions.

Why it matters

CVE-2026-40375 allows an authorized attacker to disclose information over a network due to missing authorization in Dynamics Business Central. Defenders should prioritize verifying and patching affected versions, reviewing access controls, and monitoring for suspicious activity.

• Verify and patch affected Microsoft Dynamics 365 Business Central versions to prevent information disclosure
• Review and update access controls to prevent unauthorized access
• Monitor for suspicious activity related to information disclosure

Technical summary

The vulnerability is caused by missing authorization in Dynamics Business Central, allowing an authorized attacker to disclose information over a network. This vulnerability affects Microsoft Dynamics 365 Business Central deployments. The vulnerability allows an authorized attacker to disclose information over a network due to missing authorization in Dynamics Business Central. Defenders should prioritize verifying and patching affected Microsoft Dynamics 365 Business Central versions, reviewing access controls, and monitoring for suspicious activity related to

Defensive priority

Defenders should prioritize verifying and patching affected Microsoft Dynamics 365 Business Central versions.

Recommended defensive actions

• Verify and patch affected Microsoft Dynamics 365 Business Central versions
• Review and update access controls to prevent unauthorized access
• Monitor for suspicious activity related to information disclosure

Evidence notes

The CVE record and source item provide details on the vulnerability, but specific exploitation or impact instances are not mentioned. The vulnerability is confirmed to exist in Microsoft Dynamics 365 Business Central, but the exact scope and affected versions are not detailed in the provided sources. Defenders should verify and patch affected versions, review access controls, and monitor for suspicious activity related to information disclosure. The source item and CVE record provide a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.