When Does an Outdated NAV System Become a Management Challenge?

Companies around the world are successfully using Microsoft Dynamics NAV. Since its introduction, it has served as the core system for mapping business processes at many companies. In many cases, it has been extensively customized to fit the company’s needs. 

However, the environment in which companies operate is constantly changing due to new regulatory requirements, market opportunities and demands, as well as rapid technological developments. As the central application within the company, the ERP system must keep pace. When is the right time to modernize the system and keep it continuously up to date? 

The recently discovered security vulnerability CVE-2026-55944 is not the only reason to ask this question, but it is certainly the most urgent one. 

Operating a modern, cloud-based ERP system such as Microsoft Business Central Online in the COSMO Cloud offers real added value for companies: measurable efficiency gains through the use of AI, end-to-end digitization of business processes, and a level of security that is virtually unattainable on on-premises servers. 

When operating an old NAV system, the company misses out on these benefits. At the same time, it incurs the effort of securing the environment surrounding the outdated NAV system and averting potential damage to the company. Residual risks remain. 

This is because while the ERP system remains in its current state, attackers’ tools are evolving rapidly, allowing them to discover and exploit weaknesses in the software that have gone unnoticed for years. 

The recently disclosed security vulnerability CVE-2026-55944 is a particularly notable example. 

The “CVE” in the security vulnerability CVE-2026-55944 stands for Common Vulnerabilities and Exposures; the numbers that follow represent the year of registration and a sequential number. This system allows publicly documented security vulnerabilities to be uniquely identified. 

The associated CVSS (Common Vulnerability Scoring System) score describes the severity on a scale from 0.0 (None) to 10.0 (Critical). 

CVE-2026-55944 affects Microsoft Dynamics NAV 2018 and has a remarkably high CVSS score of 9.8. This corresponds to the “Critical” rating: An attacker could remotely execute malicious code without having to log in. 

Although, based on current information, only the NAV 2018 version is affected, the vulnerability highlights the risk associated with operating an outdated NAV system. This risk extends to other on-premises systems involved, such as SQL Server, Windows Server, and other components. A vulnerability in any of these systems can have repercussions for business operations far beyond the ERP system itself. 

Driven in part by global tensions and AI systems that are said to attack companies on their own initiative, 82% of German business owners—according to Bitkom (Economic Security 2025)—expect an increase in cyberattacks over the next twelve months. 

Migrating to Business Central Online can be daunting. It doesn’t happen overnight and requires thorough preparation. That’s why it’s important to assess your current situation early on and plan pragmatically: 

What resources do I need to allocate—both for service providers and internally? 

What steps are required, in what order, and how long will they take? 

What can I prepare on my own, well before the official project kick-off? 

The sooner these questions are answered, the sooner preparatory steps can be initiated, and the greater the certainty in planning. 

The Cloud Innovation Assessment answers these and many related questions. Last year, COSMO CONSULT conducted it 50 times. 

What sets this assessment apart is that it is conducted by consultants with hands-on experience in migration projects. 

Its core focus is on taking a holistic view of the long-term digitalization strategy while also concretely planning the migration of the ERP system as a central component: process model, effort, timeline, and division of labor. 

The CVE-2026-55944 security vulnerability is a prime example of the risks associated with operating legacy NAV systems.  

At the same time, regulatory requirements and operational challenges make it clear that a system is not future-proof simply because it still functions—albeit barely. 

And don’t forget: Migrating to Business Central Online delivers added value for business operations and lays the foundation for further digitalization, automation, and the use of AI. 

If you’d like to find out what your company’s cloud migration might look like, visit our ERP Cloud Transformation page for more information and concrete starting points for planning your project. 

Take the first step toward gaining planning certainty. 

Doing nothing is the more expensive option in the long run.