High severity · published Jul 14, 2021
CVE-2021-34474
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
8.0
CVSS
2.2%
EPSS
No
On KEV
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MD
Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.14 · Microsoft
16.0 before 16.0.27253 · source: vendor
MD
Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.8 · Microsoft
17.0 before 17.0.27235 · source: vendor
MD
Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.3 · Microsoft
18.0 before 18.0.27469 · source: vendor
D3
Dynamics 365 Business Central · Microsoft
2020; 2020; 2021 · source: NVD
Affected product
MD
Microsoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.14
Microsoft