CVE-2026-0509

Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no impact on the confidentiality of the application.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

Netweaver As Abap Kernel Netweaver As Abap Krnl64nuc Netweaver As Abap Krnl64uc and 1 more

CVE-2026-23681

Missing Authorization check in a function module in SAP Support Tools Plug-In

Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to retrieve information about the system and its configuration. This disclosure of the system information could assist the attacker to plan subsequent attacks. This vulnerability has a low impact on the confidentiality of the application, with no effect on its integrity or availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

Solution Tools Plug-in Sap Support Tools Plug-in

CVE-2026-23688

Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services)

SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

S4core Sap Fiori App (manage Service Entry Sheets - Lean Services)

CVE-2026-24319

Information Disclosure Vulnerability in SAP Business One (B1 Client Memory Dump Files)

In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could potentially lead to unauthorized operations within the B1 environment, including modification of company data. This issue results in a high impact on confidentiality and integrity, with no impact on availability.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

Business One Sap Business One (b1 Client Memory Dump Files)

CVE-2026-24320

Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)

Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

Netweaver As Abap Kernel Netweaver As Abap Krnl64nuc Netweaver As Abap Krnl64uc and 1 more

CVE-2026-24322

Missing Authorization check in SAP Solution Tools Plug-In (ST-PI)

SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing sensitive information to be disclosed. This vulnerability has a high impact on confidentiality and does not affect integrity or availability.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

Solution Tools Plug-in Sap Solution Tools Plug-in (st-pi)

CVE-2026-24323

Multiple vulnerabilities in BSP Applications of SAP Document Management System

The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

Document Management System Erp S4core and 1 more

CVE-2026-24324

Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools)

SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools that could cause the Content Management Server (CMS) to crash, rendering the CMS partially or completely unavailable and resulting in the denial of service of the Content Management Server (CMS). Successful exploitation impacts system availability, while confidentiality and integrity remain unaffected.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

Businessobjects Business Intelligence Platform Sap Business Objects Business Intelligence Platform

CVE-2026-24325

Cross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Management Console)

SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.This vulnerability has low impact on confidentiality and integrity of the data. There is no impact on the availability of the application.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

Businessobjects Enterprise Sap Businessobjects Enterprise (central Management Console)

CVE-2026-24326

Missing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations)

Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-enabled function modules to do direct update on standard SAP database table . This results in low impact on integrity, with no impact on confidentiality or availability of the application.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

S\/4hana Defense \& Security Sap S/4hana Defense & Security (disconnected Operations)

CVE-2026-24327

Missing Authorization Check in SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application)

Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This leads to low impact on confidentiality and no effect on integrity or availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

Strategic Enterprise Management Sap Strategic Enterprise Management (balanced Scorecard In Bsp Application)

CVE-2026-24328

Open Redirection vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)

SAP TAF_APPLAUNCHER within Business Server Pages allows unauthenticated attacker to craft malicious links that, when clicked by a victim, redirect them to attacker?controlled sites, potentially exposing or altering sensitive information in the victim�s browser. This results in a low impact on confidentiality and integrity, with no impact on the availability of the application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

Business Server Pages Business Server Pages Application (taf Applauncher)

CVE-2026-24314

Information Disclosure vulnerability in S/4HANA (Manage Payment Media)

Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Sap Se

Products

S\/4hana Uiapfi70 S\/4hana Uis4h S/4hana (manage Payment Media)

CVE-2026-24318

Insecure Session Management vulnerability in SAP BusinessObjects Business Intelligence Platform

Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuse them to gain unauthorized access to a victim�s session. If the application continues to accept previously issued tokens after authentication, the attacker could assume the victim�s authenticated context. This could allow the attacker to access or modify information within the victim�s session scope, impacting confidentiality and integrity, while availability remains unaffected.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Business Objects Business Intelligence Platform

CVE-2026-27683

Reflected cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform

SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs. When a victim accesses the URL, the script executes in the user�s browser, potentially exposing restricted information. This results in a low impact on confidentiality with no impact on integrity and availability.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Business Objects Business Intelligence Platform

CVE-2026-0489

DOM-based Cross-Site Scripting (XSS) Vulnerability in SAP Business One (Job Service)

Due to insufficient validation of user-controlled input in the URLs query parameter. SAP Business One Job Service could allow an unauthenticated attacker to inject specially crafted input which upon user interaction could result in a DOM-based Cross-Site Scripting (XSS) vulnerability. This issue had a low impact on the confidentiality and integrity of the application with no impact on availability.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Business One (job Service)

CVE-2026-24311

Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0

The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Customer Checkout 2.0

CVE-2026-24313

Missing Authorization check in SAP Solution Tools Plug-In (ST-PI)

SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing system information to be disclosed. This vulnerability has a low impact on confidentiality and does not affect integrity or availability.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Solution Tools Plug-in (st-pi)

CVE-2026-27684

SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification)

SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacker to inject arbitrary SQL code through user-controlled input fields. The application concatenates these inputs directly into SQL queries without proper validation or escaping. As a result, an attacker can manipulate the WHERE clause logic and potentially gain unauthorized access to or modify database information. This vulnerability has no impact on integrity and low impact on the confidentiality and availability of the application.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Netweaver (feedback Notification)

CVE-2026-27686

Missing Authorization check in SAP Business Warehouse (Service API)

Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Business Warehouse (service Api)