An insecure deserialization flaw in Microsoft Dynamics NAV 2018 enables unauthenticated remote code execution, presenting a critical security risk.

The application incorrectly deserializes untrusted data (CWE-502). This allows an unauthenticated attacker to trigger malicious code execution by sending specifically crafted serialized objects to the application.

With a CVSS score of 9.8, this vulnerability is critical. Exploitation allows an attacker to gain full control over the application server, potentially resulting in the theft of sensitive financial or business data, long-term persistence within the environment, and significant operational downtime.

Immediate Action: Update Microsoft Dynamics NAV 2018 to version 11.0.50704.0 or later immediately. Follow the official Microsoft security update guidance to ensure the patch is applied correctly.

Proactive Monitoring: Audit application logs for suspicious deserialization activity or unexpected system calls. Monitor for unusual service behavior or unauthorized modifications to application files.

Compensating Controls: Implement strict network access controls to limit exposure of the Dynamics NAV interface to trusted internal networks only. Use an application-level firewall to inspect incoming traffic for serialized objects.

Public Exploit Available: Unknown

The severity of this issue necessitates an urgent patching cycle. Organizations should verify their current version of Dynamics NAV and upgrade to the specified fixed version to prevent potential remote exploitation.