CVE-2026-0486

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0486", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2025-12-09T22:06:30.443Z", "datePublished": "2026-02-10T03:00:59.297Z", "dateUpdated": "2026-02-10T15:45:30.862Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ABAP based SAP systems", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "ST-PI 2005_1_700"}, {"status": "affected", "version": "2008_1_710"}, {"status": "affected", "version": "740"}, {"status": "affected", "version": "758"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system information.This has low impact on confidentiality. Integrity and availability are not impacted.</p>"}], "value": "In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system information.This has low impact on confidentiality. Integrity and availability are not impacted."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862: Missing Authorization", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:00:59.297Z"}, "references": [{"url": "https://me.sap.com/notes/3691645"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Missing Authorization Check in ABAP based SAP systems", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T15:45:17.426866Z", "id": "CVE-2026-0486", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:45:30.862Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0486", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T15:45:17.426866Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:45:21.935Z"}}], "cna": {"title": "Missing Authorization Check in ABAP based SAP systems", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "ABAP based SAP systems", "versions": [{"status": "affected", "version": "ST-PI 2005_1_700"}, {"status": "affected", "version": "2008_1_710"}, {"status": "affected", "version": "740"}, {"status": "affected", "version": "758"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3691645"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system information.This has low impact on confidentiality. Integrity and availability are not impacted.", "supportingMedia": [{"type": "text/html", "value": "<p>In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system information.This has low impact on confidentiality. Integrity and availability are not impacted.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:00:59.297Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0486", "state": "PUBLISHED", "dateUpdated": "2026-02-10T15:45:30.862Z", "dateReserved": "2025-12-09T22:06:30.443Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-02-10T03:00:59.297Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ABAP based SAP systems", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "ST-PI 2005_1_700"}, {"status": "affected", "version": "2008_1_710"}, {"status": "affected", "version": "740"}, {"status": "affected", "version": "758"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:solution_tools_plug-in:740:*:*:*:*:*:*:*", "matchCriteriaId": "3E087FCF-62FE-48A7-80B1-1BEDEA5716D6", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:solution_tools_plug-in:758:*:*:*:*:*:*:*", "matchCriteriaId": "F9C9CBFC-453A-4B9E-87B6-466369CE6AD6", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:solution_tools_plug-in:2005_1_700:*:*:*:*:*:*:*", "matchCriteriaId": "9DB77DE3-2703-4A42-BE41-D37F312A7A9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:solution_tools_plug-in:2008_1_710:*:*:*:*:*:*:*", "matchCriteriaId": "4836C482-5A64-4373-BCB4-0185BDF83EAD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system information.This has low impact on confidentiality. Integrity and availability are not impacted."}, {"lang": "es", "value": "En sistemas SAP basados en ABAP, un m\u00f3dulo de funci\u00f3n habilitado remotamente no realiza las comprobaciones de autorizaci\u00f3n necesarias para un usuario autenticado, resultando en la divulgaci\u00f3n de informaci\u00f3n del sistema. Esto tiene bajo impacto en la confidencialidad. La integridad y la disponibilidad no se ven impactadas."}], "id": "CVE-2026-0486", "lastModified": "2026-06-17T10:10:49.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "cna@sap.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0486", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T15:45:17.426866Z", "version": "2.0.3"}}]}, "published": "2026-02-10T04:16:01.550", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3691645"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "ST-PI 2005_1_700"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2008_1_710"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "740"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "758"}}], "product": "abap_based_sap_systems", "vendor": "sap_se"}], "analysis": {"en": {"generated_at": "2026-04-18T12:55:09.784514+00:00", "value": {"mitigation_remediation": ["Apply the SAP Note 3691645 patch to insert the missing authorization checks in the vulnerable function module.", "If a custom implementation exists or the patch does not cover the specific function module, add explicit authorization object checks to enforce proper access control.", "Restrict the execution of the function module by assigning it only to trusted roles and limiting role memberships."], "summary": {"action": "Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Affected installations include ABAP based SAP systems that use the Solution Tools plug\u2011in packages 2005_1_700, 2008_1_710, 740, and 758. Version details are not specified in the advisory, so any deployment of these plugins may be vulnerable.", "description_and_impact": "The flaw lies in ABAP based SAP systems where a remotely enabled function module omits required authorization checks for an authenticated user, allowing disclosure of system information. The vulnerability has a low confidentiality impact and does not affect integrity or availability.", "risk_and_exploitability": "The CVSS base score of 5 indicates medium severity, while the EPSS score of less than 1% suggests limited exploitation likelihood. The vulnerability is not listed in CISA KEV. The likely attack scenario involves a user who has authenticated to the SAP environment and can invoke the function module through the SAP interface, thereby retrieving restricted system data. Since integrity and availability remain unaffected, the predominant risk is controlled information leakage to authenticated accounts."}}}}, "created": "2026-02-10T11:34:45.596026+00:00", "updated": "2026-04-18T13:00:08.757826+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$abap_based_sap_systems"]}