Medium severity · published Apr 8, 2025
CVE-2025-29821
Microsoft Dynamics Business Central Information Disclosure Vulnerability
5.5
CVSS
0.7%
EPSS
No
On KEV
Description
Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MD
Microsoft Dynamics 365 Business Central 2023 Wave 2 · Microsoft
23.0 before 23.0.32309 · source: vendor
MD
Microsoft Dynamics 365 Business Central 2024 Wave 1 2024 · Microsoft
24.0 before 24.0.32305 · source: vendor
MD
Microsoft Dynamics 365 Business Central 2024 Wave 2 · Microsoft
25.0 before 25.2.32308 · source: vendor
MD
Microsoft Dynamics 365 Business Central 2025 Wave 1 · Microsoft
26.0 before 26.0.32481 · source: vendor
D3
Dynamics 365 Business Central 2023 · Microsoft
23.1.13812 before 23.18.32409 · source: NVD
D3
Dynamics 365 Business Central 2024 · Microsoft
before 24.12.32447; 25.1.25900 before 25.6.32556 · source: NVD
D3
Dynamics 365 Business Central 2025 · Microsoft
before 26.0.32481 · source: NVD
Affected product
MD
Microsoft Dynamics 365 Business Central 2023 Wave 2
Microsoft