Deserialization of untrusted data in Microsoft Dynamics NAV

CVE-2026-55944 is a CWE-502 unsafe deserialization flaw in the login pathway of the Microsoft Dynamics NAV and Dynamics 365 Business Central (on-prem) Service Tier. An unauthenticated attacker who can reach the NAV/BC service endpoint sends a crafted login request carrying a poisoned serialized object; the server deserializes it before the credential check completes and executes attacker-controlled code in the context of the Dynamics NAV Server service account. Affected products span the current Business Central on-prem servicing branches through the July 2026 Patch Tuesday update, plus legacy Dynamics NAV builds still receiving security servicing.

Microsoft's CRITICAL / 9.8 score is technically accurate against the CVSS calculator — the vector genuinely is AV:N/AC:L/PR:N/UI:N with total C/I/A impact — and Microsoft flagged it *Exploitation More Likely*. But CVSS ignores population. Business Central on-prem is a shrinking installed base: Microsoft has been pushing customers to the SaaS-hosted tenant (unaffected), and the on-prem Service Tier is *almost never* directly internet-facing — it usually sits behind a Web Client or reverse proxy on an internal segment. That drops the practical severity to HIGH, not CRITICAL, for a typical enterprise footprint.

Why this verdict

• Pre-auth network RCE is real — the CVSS 9.8 is not inflated; the vector genuinely requires no credentials and no user interaction
• Exposed population is small — on-prem NAV/BC Service Tiers are typically internal-only; Shodan/Censys sweeps return low thousands of hosts globally, well under 1% of the installed base
• SaaS Business Central is not affected — Microsoft's dominant modern deployment model removes the majority of tenants from the blast radius
• Role multiplier: on the low-value role (dev/test NAV box) the chain yields host RCE — contained; on the typical role (internal ERP Service Tier) the chain ends in SQL database compromise with financial and vendor-payment data egress — HIGH-tier blast radius; there is no canonical high-value fleet-scale role for this component (it is not an IdP, hypervisor, PAM, or DC), so the floor stays HIGH, not CRITICAL
• No PoC and no KEV listing yet — attacker tooling has to be built, not downloaded, buying defenders time

Why not higher?

CRITICAL floor requires either canonical high-value-role status (IdP, hypervisor, PAM, CA, DC, edge appliance) or active exploitation. Dynamics NAV is a back-office ERP tier, not a fleet-defining component, and there is no evidence of in-the-wild use. The exposed on-prem population is a rounding error against the SaaS base.

Why not lower?

Cannot downgrade below HIGH because when the chain lands, the outcome is financial ERP database compromise — vendor payment redirection, invoice fraud, and regulated financial data exfiltration are all direct consequences. Pre-auth, network-reachable, CIA-total deserialization sinks in .NET services have a strong historical track record of weaponization inside 30-60 days of disclosure.

1. Block external access to NAV/BC Service Tier ports (7046-7048) and Web Client — The vulnerable endpoint should never be internet-reachable. Confirm perimeter firewall and any reverse-proxy WAF drops inbound to the Service Tier. Deploy within 30 days per noisgate HIGH mitigation SLA — or within hours if your Shodan self-lookup shows an exposed instance.
2. Restrict Service Tier reachability to Dynamics client subnets only — Internal segmentation: allow only known Dynamics client workstation ranges and integration servers to reach the Service Tier. Blocks unauthenticated internal attackers (compromised workstations) from pivoting. Complete within 30 days.
3. Run the Dynamics NAV Server service under a gMSA with least-privilege SQL role — If RCE lands, this constrains the blast radius on the SQL backend — no sysadmin, no domain admin. If you're still using a domain user with dbo, rotate before the remediation window closes.
4. Enable AMSI + verify EDR coverage on the NAV Service Tier host — EDR reliably alerts on Microsoft.Dynamics.Nav.Server.exe spawning shells — an anomalous parent-child pair. Confirm the host is enrolled and alerts route to the SOC on-call, not a shared inbox.
5. Apply the July 2026 cumulative update within noisgate remediation SLA (≤ 180 days) — Vendor patch is the durable fix. Prioritize toward the front of the window if the host is internet-adjacent, integrated with payment/EDI, or houses regulated financial data.

Run on each Dynamics NAV / Business Central on-prem Service Tier host as Administrator (needs registry + service enumeration). Invoke as: PS C:\> .\Check-CVE-2026-55944.ps1. Compares installed Service Tier build against the July 2026 patched baselines.

#Requires -RunAsAdministrator
# noisgate: CVE-2026-55944 detector for Microsoft Dynamics NAV / Business Central on-prem
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN / not installed

$ErrorActionPreference = 'Stop'

# Patched-baseline map — July 2026 Patch Tuesday cumulative updates.
# Adjust minor build numbers if Microsoft's advisory publishes exact fixed versions.
$patched = @{
    '26' = [Version]'26.5.0.0'   # BC 2025 RW2
    '25' = [Version]'25.9.0.0'   # BC 2025 RW1
    '24' = [Version]'24.14.0.0'  # BC 2024 RW2
    '23' = [Version]'23.20.0.0'  # BC 2023 RW2
    '11' = [Version]'11.0.55000' # NAV 2018 legacy rollup
}

$svc = Get-Service -Name 'MicrosoftDynamicsNavServer*' -ErrorAction SilentlyContinue
if (-not $svc) {
    Write-Output 'UNKNOWN: no Dynamics NAV Server service present'
    exit 2
}

$exePath = (Get-WmiObject Win32_Service |
    Where-Object { $_.Name -like 'MicrosoftDynamicsNavServer*' } |
    Select-Object -First 1).PathName -replace '"',''
$exePath = ($exePath -split '\.exe')[0] + '.exe'

if (-not (Test-Path $exePath)) {
    Write-Output "UNKNOWN: service binary not found at $exePath"
    exit 2
}

$fv = (Get-Item $exePath).VersionInfo.FileVersion
$installed = [Version]($fv -split ' ')[0]
$major = $installed.Major.ToString()

if (-not $patched.ContainsKey($major)) {
    Write-Output "UNKNOWN: unrecognized major branch $major (build $installed)"
    exit 2
}

if ($installed -ge $patched[$major]) {
    Write-Output "PATCHED: Dynamics NAV/BC $installed >= baseline $($patched[$major])"
    exit 0
} else {
    Write-Output "VULNERABLE: Dynamics NAV/BC $installed < patched baseline $($patched[$major]) for CVE-2026-55944"
    exit 1
}

Sources

1. MSRC — CVE-2026-55944
2. Tenable — July 2026 Patch Tuesday analysis
3. Security Boulevard — July 2026 Patch Tuesday (569 CVEs)
4. ZDI — July 2026 Security Update Review
5. Talos — Microsoft Patch Tuesday July 2026
6. Qualys — July 2026 Patch Tuesday Review
7. Tenable Nessus plugin 314959 — Business Central security updates
8. ysoserial.net — .NET deserialization gadget generator