CVE-2026-0494

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0494", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2025-12-09T22:06:36.684Z", "datePublished": "2026-01-13T01:13:14.370Z", "dateUpdated": "2026-01-13T16:19:32.833Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP Fiori App (Intercompany Balance Reconciliation)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "UIAPFI70 500"}, {"status": "affected", "version": "600"}, {"status": "affected", "version": "700"}, {"status": "affected", "version": "800"}, {"status": "affected", "version": "900"}, {"status": "affected", "version": "901"}, {"status": "affected", "version": "902"}, {"status": "affected", "version": "UIS4H 109"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricted. This has low impact on confidentiality of the application, integrity and availability are not impacted.</p>"}], "value": "Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricted. This has low impact on confidentiality of the application, integrity and availability are not impacted."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-01-13T01:13:14.370Z"}, "references": [{"url": "https://me.sap.com/notes/3655227"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Information Disclosure vulnerability in SAP Fiori App (Intercompany Balance Reconciliation)", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T16:19:26.654230Z", "id": "CVE-2026-0494", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T16:19:32.833Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0494", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T16:19:26.654230Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T16:19:29.880Z"}}], "cna": {"title": "Information Disclosure vulnerability in SAP Fiori App (Intercompany Balance Reconciliation)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Fiori App (Intercompany Balance Reconciliation)", "versions": [{"status": "affected", "version": "UIAPFI70 500"}, {"status": "affected", "version": "600"}, {"status": "affected", "version": "700"}, {"status": "affected", "version": "800"}, {"status": "affected", "version": "900"}, {"status": "affected", "version": "901"}, {"status": "affected", "version": "902"}, {"status": "affected", "version": "UIS4H 109"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3655227"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricted. This has low impact on confidentiality of the application, integrity and availability are not impacted.", "supportingMedia": [{"type": "text/html", "value": "<p>Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricted. This has low impact on confidentiality of the application, integrity and availability are not impacted.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-497", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-01-13T01:13:14.370Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0494", "state": "PUBLISHED", "dateUpdated": "2026-01-13T16:19:32.833Z", "dateReserved": "2025-12-09T22:06:36.684Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-01-13T01:13:14.370Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Fiori App (Intercompany Balance Reconciliation)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "UIAPFI70 500"}, {"status": "affected", "version": "600"}, {"status": "affected", "version": "700"}, {"status": "affected", "version": "800"}, {"status": "affected", "version": "900"}, {"status": "affected", "version": "901"}, {"status": "affected", "version": "902"}, {"status": "affected", "version": "UIS4H 109"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricted. This has low impact on confidentiality of the application, integrity and availability are not impacted."}, {"lang": "es", "value": "Bajo ciertas condiciones, la aplicaci\u00f3n SAP Fiori Intercompany Balance Reconciliation permite a un atacante acceder a informaci\u00f3n que de otro modo estar\u00eda restringida. Esto tiene un bajo impacto en la confidencialidad de la aplicaci\u00f3n; la integridad y la disponibilidad no se ven afectadas."}], "id": "CVE-2026-0494", "lastModified": "2026-06-17T10:10:50.533", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0494", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T16:19:26.654230Z", "version": "2.0.3"}}]}, "published": "2026-01-13T02:15:51.667", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3655227"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-497"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:51:37.250960+00:00", "value": {"mitigation_remediation": ["Apply the SAP security update identified by Note 3655227, which addresses this information disclosure in the Fiori App (Intercompany Balance Reconciliation).", "Enforce strict access controls on the application by ensuring that only users with the appropriate roles can access intercompany balance data and by removing unnecessary permissions. ", "Continuously monitor audit trails for unusual attempts to view restricted information and respond promptly to any detected anomalies."], "summary": {"action": "Assess Impact", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the SAP Fiori App (Intercompany Balance Reconciliation) component of SAP, with no specific version information listed. Users running this application should verify whether the installed build is susceptible.", "description_and_impact": "SAP Fiori App (Intercompany Balance Reconciliation) provides an information disclosure flaw that lets a compromised user read data that should have been restricted. The impact is primarily a modest loss of confidentiality; the flaw does not alter the system\u2019s integrity or availability and is classified as low severity with a CVSS score of 4.3.", "risk_and_exploitability": "With an EPSS score below 1% and no listing in the CISA KEV catalog, the likelihood of immediate exploitation is low. The attack vector is inferred to arise from within the application layer, potentially by users who gain access to the Fiori app under certain conditions. Because the flaw does not grant elevated privileges or disrupt services, it is less attractive for large\u2011scale attacks but could still compromise sensitive data if exploited."}}}}, "created": "2026-01-13T09:26:55.487467+00:00", "updated": "2026-04-18T07:00:11.345479+00:00", "vendors": ["sap", "sap$PRODUCT$fiori"]}