AI analysis
CVE-2026-100214 is an insecure-deserialization flaw (CWE-502) in Microsoft Dynamics Business Central. An attacker who already has a low-privileged authorized account can send crafted data over the network and trigger deserialization of untrusted input, with no user interaction required. Successful exploitation gives remote code execution with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8, scope unchanged). Organizations that run Dynamics Business Central are affected, but the CVE data does not list specific version ranges. It is not in the CISA KEV catalog and no public proof-of-concept is known.
What to do: Apply the Microsoft security update that fixes CVE-2026-100214 for your Dynamics Business Central servicing channel as soon as it is offered; the CVE record does not name a fixed build, so match the update to this CVE ID rather than guessing a version. Until it is installed, restrict network access to Business Central, keep accounts at least privilege, and watch for unexpected code execution from authenticated sessions.
Affected
| Microsoft Dynamics Business Central | — |
Estimated exposure
largeOn the order of tens of thousands of customer organizations — Microsoft does not publish an install count in this CVE; public reporting has put Dynamics 365 Business Central in the tens of thousands of customer organizations, which is the basis for a large but uncertain order-of-magnitude estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.