When Does an Outdated NAV System Become a Management Challenge?

Companies around the world work successfully with Microsoft Dynamics NAV. Although it is showing its age, it has often served as the core system for mapping business processes since its introduction—and in many cases has been extensively customized to meet the company’s needs. 

But the environment in which companies operate is constantly changing, driven by new regulatory requirements, market opportunities and demands, and rapid technological developments. As a company’s central application, its ERP system has to keep pace. When is the time right to modernize the system and keep it continuously up to date? 

The recently discovered CVE-2026-55944 vulnerability is not the only reason to ask this question, but it is certainly the most urgent. 

Running a current, cloud-based ERP system such as Microsoft Business Central Online offers companies real benefits: measurable efficiency gains through the use of AI, end-to-end digitization of business processes, and a level of security that is virtually impossible to achieve on a company’s own servers. 

When a company runs a legacy NAV system, it misses out on these benefits. At the same time, additional effort is required to secure the environment around the outdated NAV system and prevent potential damage to the company. Residual risks remain. 

While the ERP system remains in its current state, attackers’ tools continue to evolve rapidly, making it possible to discover and exploit software weaknesses that have gone unnoticed for years. 

The recently disclosed CVE-2026-55944 vulnerability is one such weakness—and a particularly noteworthy one. 

“CVE” stands for Common Vulnerabilities and Exposures. The numbers that follow indicate the year of registration and a sequential number. This system makes it possible to uniquely identify publicly documented vulnerabilities. 

The associated CVSS score (Common Vulnerability Scoring System) describes the severity on a scale from 0.0 (None) to 10.0 (Critical). 

CVE-2026-55944 affects Microsoft Dynamics NAV 2018 and has a remarkably high CVSS score of 9.8. This corresponds to the Critical rating: an attacker could execute malicious code remotely without having to log in. 

Although, according to current information, only NAV 2018 is affected, the vulnerability highlights the risks associated with running a legacy NAV system. These risks also apply to other on-premises systems involved, including SQL Server, Windows Server, and other components. A vulnerability in any one of these systems can affect business operations far beyond the ERP system itself. 

At the same time, the likelihood of such a risk materializing is increasing amid global tensions and AI systems that appear to attack companies autonomously: according to Bitkom (Economic Security 2025), 82 percent of German companies expect cyberattacks to increase over the next twelve months. 

Other limitations of a legacy NAV system may be less dramatic than a digital break-in, but they can be all the more “annoying.” One example is the need to adapt to regulatory changes, such as revised Intrastat requirements and new bank formats, as well as the current obligation to introduce e-invoicing. 

But why “annoying”? With the current version of Business Central Online, Microsoft and its partners provide updates for the application. Installing them takes just one click. With NAV, code downgrades from higher versions are often necessary. In the worst case, implementation may no longer be possible at all, requiring an inefficient workaround to be built alongside the system. 

Another example: to meet operational requirements, the NAV system needs to be extended with an add-on—whether to manage down payment schedules in the future, equip warehouse staff with handheld scanners, or import delivery schedules from business partners directly into the ERP system. 

Thanks to NAV’s open architecture, a custom implementation is often still possible. But, as noted above, it is typically costly and leaves the add-on’s long-term maintainability uncertain. In the worst case, those responsible may have to consider forgoing the extension. Progress is held back, the company cannot move forward, and users are left managing their work with paper forms. 

In any case, it is an illusion to think that sticking with the existing system—and the supposed savings that come with it—is a good “investment.” This holds true regardless of the missed opportunity to use AI, critical security vulnerabilities, or spectacular hacker attacks. 

Migrating to Business Central Online involves a certain level of complexity. It cannot happen overnight and needs to be carefully prepared. That is why it is important to assess your starting point early and plan objectively: 

• What costs and effort should I plan for, both for service providers and internally?
• Which steps are required, in what order, and how long will they take?
• What can I prepare myself well in advance of the official project kick-off? 

The sooner these questions are answered, the sooner preparatory steps can begin—and the greater the planning certainty. 

The Cloud Innovation Assessment answers these and many related questions. Last year, COSMO CONSULT conducted it 50 times. 

One of the assessment’s distinguishing features is that it is carried out by consultants with hands-on experience in migration projects. 

Its key components are to take a holistic view of the long-term digitalization strategy while also planning the ERP system migration in concrete terms as a central building block: the approach, effort, time frame, and division of responsibilities. 

The CVE-2026-55944 vulnerability is an example of the uncertainty that can come with running legacy NAV systems. 

At the same time, regulatory requirements and operational challenges make it clear that a system is not fit for the future simply because it still works—for now. 

And let’s not forget: migrating to Business Central Online brings benefits to business operations and lays the foundation for further digitalization, automation, and the use of AI. 

If you would like to find out what cloud migration could look like for your company, visit our ERP Cloud Transformation page for further information and practical starting points for planning your project. 

Take the first step toward gaining planning certainty. 

Doing nothing is the more expensive option in the long run.