CVE-2022-41127

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft	Microsoft Dynamics NAV 2016	>= 1.0, < Build 52203
Microsoft	Microsoft Dynamics NAV 2017	>= 1.0, < Build 30712
Microsoft	Microsoft Dynamics NAV 2018	>= 1.0, < Build 49497
Microsoft	Microsoft Dynamics NAV 2015	>= 1.0, < 52204
Microsoft	Dynamics 365 Business Central Spring 2019 Update	>= 14.0.0, < App Build 14.43.49498, Platform Build 14.0.49494
Microsoft	Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)	>= 15.0.0, < App Build 15.17.48428, Platform Build 15.0.48
Microsoft	Microsoft Dynamics 365 Business Central 2020 Release Wave 2	>= 17.0.0, < App Build 17.17.38111, Platform Build 17.0.38061
Microsoft	Microsoft Dynamics 365 Business Central 2020 Release Wave 1	>= 16.0.0, < App Build 16.19.35126, Platform Build 16.35120
Microsoft	Microsoft Dynamics 365 Business Central 2022 Release Wave 1	>= 20.0.0, < App Build 20.8.49971, Platform Build 20.0.49947
Microsoft	Microsoft Dynamics 365 Business Central 2021 Release Wave 2	>= 19.0.0, < App Build 19.14.49970, Platform Build 19.0.49925
Microsoft	Microsoft Dynamics 365 Business Central 2022 Release Wave 2	>= 21.0.0, < App Build 21.2.49990, Platform Build 21.0.49984
Microsoft	Microsoft Dynamics 365 Business Central 2021 Release Wave 1	>= 18.0.0, < App Build 18.18.46920, Platform Build 18.0.46905
Microsoft	Microsoft Dynamics NAV 2013 R2	>= 1.0, < 52297

References

Timeline

Published: Dec 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-411288.8Windows Scripting Languages Remote Code Execution Vulnerability CVE-2022-411317.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Ap CVE-2022-411326.1Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.CVE-2022-411338.8The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_setting CVE-2022-411348.8Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versio CVE-2022-411355.3Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.CVE-2022-411368.8Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugi CVE-2022-411378.3Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions t CVE-2022-411389.8In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.CVE-2022-411395.4MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary com CVE-2022-41145.4The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perf CVE-2022-411408.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authent