CVE-2014-0261: Microsoft Dynamics AX 4.0 SP2, 2009 SP1, 2012, and 2012 R2 allows remote authenticated users to cause a den...

Security readout for executives and security teams

CVE-2014-0261 is a denial-of-service issue in Microsoft Dynamics AX. An authenticated remote user could send crafted data to an Application Object Server instance and cause an instance outage. The business risk is service disruption for organizations still running the listed legacy Dynamics AX versions. Exposure is most likely in environments still operating Microsoft Dynamics AX 4.0 SP2, 2009 SP1, 2012, or 2012 R2 with reachable AOS instances. Authentication is required, so risk depends on account access, network access, and how critical the AX instance is to operations. Treat this as a legacy-platform availability risk. Prioritize if Dynamics AX supports finance, operations, inventory, or other core business functions, especially where many users or broad internal networks can reach AOS services. Mitigation focus: Inventory Dynamics AX versions and identify all AOS instances.; Review Microsoft MS14-004 for applicable vendor update or mitigation guidance.; Limit AOS network access to required users, application tiers, and management networks..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.