This article applies to Microsoft Dynamics 365 Business Central (on-premises deployments) for all countries and all language locales.
A remote code execution vulnerability exists in Microsoft Dynamics NAV. A user who has the permission to access certain features that requires a call from the Role-Tailored Client that has the dataset structure can start arbitrary shell commands through deserialization.
To learn more about the vulnerability, go to CVE-2020-0905.
Overview
When you upgrade on-premises deployments to this update, you and your customers must use a new license that covers more scenarios than the one for the original release in October 2018.
Why this new license?
In cumulative update 1 (CU1), we enabled new licensing scenarios so that Business Central is optimized for licenses that have named users. This was not fully supported in the RTM version that was made available on October 1, 2018. Therefore, CU1 requires a new license. You can pull new licenses when you upgrade customers to CU1.
The new licenses are required for CU1 and later versions of Business Central. They are not backwards compatible with earlier versions of Business Central.
What has changed?
In CU1, Business Central supports the product line IDs 49, 74, 75, and 76 for named users. For more information, see Microsoft Dynamics 365 Business Central Pricing and Licensing.
This cumulative update includes all hotfixes and regulatory features that have been released for Microsoft Dynamics 365 Business Central, including hotfixes and regulatory features that were released in previous cumulative updates.
This cumulative update replaces previously released cumulative updates. You should always install the latest cumulative update.
It may be necessary to update your license after you install this hotfix to gain access to new objects that are included in this or a previous cumulative update. (This applies only to customer licenses.)
For a list of cumulative updates that were released for Microsoft Dynamics 365 Business Central, see released cumulative updates for Microsoft Dynamics 365 Business Central. Cumulative updates are intended for new and existing customers who are running Microsoft Dynamics Released Cumulative Updates for Microsoft Dynamics 365 Business Central.
Important
We recommend that you contact your Microsoft Dynamics Partner before you install hotfixes or updates. It is important to verify that your environment is compatible with the hotfixes or updates that will be installed. A hotfix or update may cause interoperability issues with customizations and third-party products that work together with your Microsoft Dynamics 365 Business Central solution.
Problems that are resolved in this cumulative update
The following problems are resolved in this cumulative update:
Platform hotfixes
| ID | Title |
|---|---|
| 342057 | "Highcharts is not defined" error message is displayed on the Business Central Web client or in the Business Central Outlook add-ins window in Outlook. |
| 345331 | Do not make public SQL Injection command and report on Business Central Help Server. |
| 342205 | The Enable Incremental Company Deletion setting is enabled by default on Business Central on-premises server settings. |
| 341116 | The Business Central Service Tier stops responding. |
| 336723 | "Sales line already exists..." error message is displayed when you sort on a column other than the Line No. field and continue to enter the new sales lines. |
Application hotfixes
| ID | Title | Functional Area | Changed Objects |
|---|---|---|---|
| 339668 | "0 is not a valid option.\Valid options are ,Fixed,Variable." error message is displayed in configuration package when you importing data to the table. | Administration | COD 10 |
| 340903 | The Rapid Start Validate Package process is extremely slow when you import a small amount of data into the table from a spreadsheet. | Administration | COD 8611 COD 8617 |
| 343165 | If you add a default value in the Description field of an item configuration template, the related Item template is empty. | Administration | TAB 1301 |
| 341357 | The Customer - Balance to Date report doesn't display anything although there is a balance for a customer. | Finance | REP 121 REP 321 |
| 341980 | The inventory posting group and inventory posting setup are duplicated on the MenuSuite. | Finance | MEN 1010 MEN 1030 |
| 342230 | The Payment Terms code is blank when the Copy Document function is used. | Finance | COD 6620 |
| 342390 | An electronic invoice in EHF 3.0 format cannot be validated successfully when the document contains positive and negative lines and different VAT rates. | Finance | COD 1620 |
| 344051 | Inconsistent posting dates display in the vendor ledger entries and a vendor payment transaction, and cause differences between G/L and subledger. | Finance | PAG 1190 |
| 344040 | A reduction performance displays in the exponential adjust cost after you post double entries. | Inventory | COD 5895 |
| 339705 | The low-level code on the Production BOM page is against the Quantity Explosion of BOM report. | Manufacturing | PAG 5870 |
| 341841 | The E-mail field in the Customer/Vendor card does not allow more than one Email ID in Business Central on-premises. | Marketing | TAB 18 TAB 23 TAB 36 TAB 5050 Extensions: DynamicsGPDataMigrationV2 |
| 346564 | "The length of the string is *, but it must be less than or equal to 250" error message is displayed in all Power BI embed scenarios. | Sales | COD 6301 |
| 340385 | The ApplicationArea property for the Work Order action item on the page is incorrect. | Sales | PAG 42 |
| 340601 | If you open the Customer Card page from the Sales Order Page, no date filter will be applied. | Sales | PAG 22 PAG 27 PAG 41 PAG 42 PAG 43 PAG 44 PAG 49 PAG 50 PAG 51 PAG 52 PAG 9300 PAG 9301 PAG 9302 PAG 9305 PAG 9308 PAG 9309 TAB 36 TAB 38 |
| 342759 | "The Item does not exist. Identification fields and values: No.='XXX' " error message is displayed when you search on few characters of Item No. in the sales order. | Sales | COD 703 TAB 27 TAB 37 TAB 39 |
| 342697 | The Available Qty. to Pick fields in the Pick worksheet include quantities that are reserved for other source documents. | Warehouse | COD 7312 COD 7314 TAB 7326 |
Local application hotfixes
AT – Austria
| ID | Title | Functional Area | Changed Objects |
|---|---|---|---|
| 344447 | The Intrastat file for January 2020 is not accepted by the authorities because the period is incorrect in the Austrian version. | Finance | REP 11106 |
CZ - Czech
| ID | Title | Functional Area | Changed Objects |
|---|---|---|---|
| 345214 | Incorrectly print the advance invoices in the Czech version. | Finance | COD 11771 |
| 340732 | The Original Document VAT Date field is missing on sales return orders in the Czech version. | Finance | PAG 6630 |
| 345221 | "Prepmt. Amt. Inv. Excl. VAT cannot be less than xxx in Sales Line" error message is displayed when you create multiple shipments for orders with advance letters in the Czech version. | Sales | TAB 111 |
| 345265 | The Deduction Line No. field is incorrect in the Sales Advance Letter Entries in the Czech version. | Sales | COD 31000 |
| 343692 | The VAT Entries merge into one line with different VAT date and the same External Document No. field in the VAT Control report in the Czech version. | VAT/Sales Tax/Intrastat | COD 31100 |
| 345702 | The visibility of the Document No. field and checking Series No. field in the VAT Control report in the Czech version. | VAT/Sales Tax/Intrastat | COD 1400 PAG 31066 PAG 31075 PAG 31098 PAG 31101 |
DACH
| ID | Title | Functional Area | Changed Objects |
|---|---|---|---|
| 341878 | Incorrect INDEX.XML file is in the GDPdU data export when the same table is used multiple times in the DACH version. | Finance | COD 11000 |
| 344447 | The Intrastat file for January 2020 is not accepted by the authorities because the period is incorrect in the DACH version. | Finance | REP 11106 |
DK – Denmark
| ID | Title | Functional Area | Changed Objects |
|---|---|---|---|
| 341092 | The information in the LineExtensionAmount tag of the OIOUBL E-invoicing is incorrect when a line discount is granted in the Danish version. | Finance | Extensions: OIOUBL |
IT – Italy
| ID | Title | Functional Area | Changed Objects |
|---|---|---|---|
| 341870 | The VAT Exemption No. field should be enlarged in the Italian version. | Finance | COD 12134 PAG 12100 REP 12181 REP 202 REP 206 REP 207 REP 5911 REP 5912 REP 5915 TAB 112 TAB 12186 COD 12184 |
NO – Norway
| ID | Title | Functional Area | Changed Objects |
|---|---|---|---|
| 340139 | If you use the reverse charge VAT and proportional VAT, the transaction does not display correctly in the Trade Settlement report in the Norwegian version. | VAT/Sales Tax/Intrastat | REP 10618 |
Local regulatory features
| ID | Title | Functional Area | Changed Objects | Extensions |
|---|---|---|---|---|
| 330006 | Support electronic tax declaration in the VAT reporting framework. | COD 740 PAG 740 REP 742 TAB 740 PAG 11410 PAG 11416 REP 11405 REP 11408 TAB 11408 TAB 11412 TAB 11413 COD 11409 COD 11420 COD 11421 COD 11422 COD 11423 COD 11424 COD 11425 | Financial Management | NLDigitalTaxDeclaration |
NO – Norway
| ID | Title | Functional Area | Changed Objects | Extensions |
|---|---|---|---|---|
| 341481 | The Payroll functionality can consider zero values like no values in the Norwegian version. | N/A | Financial Management | ImportNOPayroll |
Resolution
How to obtain the Microsoft Dynamics 365 Business Central update files
This update is available for manual download and installation from the Microsoft Download Center.
Cumulative update CU 17 for Microsoft Dynamics 365 Business Central on-premises
Which hotfix package to download
This cumulative update has multiple hotfix packages. Select and download one of the following packages depending on the country version of your Microsoft Dynamics 365 Business Central database:
| Country | Hotfix package |
|---|---|
| AT - Austria | Download the CU 17 Dynamics 365 Business Central AT package |
| AU - Australia | Download the CU 17 Dynamics 365 Business Central AU package |
| BE - Belgium | Download the CU 17 Dynamics 365 Business Central BE package |
| CH - Switzerland | Download the CU 17 Dynamics 365 Business Central CH package |
| CZ- Czech | Download the CU 17 Dynamics 365 Business Central CZ package |
| DE - Germany | Download the CU 17 Dynamics 365 Business Central DE package |
| DK - Denmark | Download the CU 17 Dynamics 365 Business Central DK package |
| ES - Spain | Download the CU 17 Dynamics 365 Business Central ES package |
| FI - Finland | Download the CU 17 Dynamics 365 Business Central FI package |
| FR - France | Download the CU 17 Dynamics 365 Business Central FR package |
| IS - Iceland | Download the CU 17 Dynamics 365 Business Central IS package |
| IT - Italy | Download the CU 17 Dynamics 365 Business Central IT package |
| NA - North America | Download the CU 17 Dynamics 365 Business Central NA package |
| NL - Netherlands | Download the CU 17 Dynamics 365 Business Central NL package |
| NO - Norway | Download the CU 17 Dynamics 365 Business Central NO package |
| NZ - New Zealand | Download the CU 17 Dynamics 365 Business Central NZ package |
| RU - Russia | Download the CU 17 Dynamics 365 Business Central RU package |
| SE - Sweden | Download the CU 17 Dynamics 365 Business Central SE package |
| UK - United Kingdom | Download the CU 17 Dynamics 365 Business Central UK package |
| All other countries | Download the CU 17 Dynamics 365 Business Central W1 package |
How to install a Microsoft Dynamics 365 Business Central cumulative update
See How to install a Microsoft Dynamics 365 Business Central cumulative update.
Prerequisites
You must have Microsoft Dynamics 365 Business Central installed to apply this hotfix.
More information
See more information about software update terminology and Microsoft Dynamics 365 Business Central.
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.