CVE-2026-0495

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0495", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2025-12-09T22:06:37.539Z", "datePublished": "2026-01-13T01:13:20.999Z", "dateUpdated": "2026-01-13T15:15:41.236Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP Fiori App (Intercompany Balance Reconciliation)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "UIAPFI70 500"}, {"status": "affected", "version": "600"}, {"status": "affected", "version": "700"}, {"status": "affected", "version": "800"}, {"status": "affected", "version": "900"}, {"status": "affected", "version": "901"}, {"status": "affected", "version": "902"}, {"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application.</p>"}], "value": "SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-15", "description": "CWE-15: External Control of System or Configuration Setting", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-01-13T01:13:20.999Z"}, "references": [{"url": "https://me.sap.com/notes/3565506"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T15:15:35.824019Z", "id": "CVE-2026-0495", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T15:15:41.236Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0495", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T15:15:35.824019Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T15:15:38.575Z"}}], "cna": {"title": "Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Fiori App (Intercompany Balance Reconciliation)", "versions": [{"status": "affected", "version": "UIAPFI70 500"}, {"status": "affected", "version": "600"}, {"status": "affected", "version": "700"}, {"status": "affected", "version": "800"}, {"status": "affected", "version": "900"}, {"status": "affected", "version": "901"}, {"status": "affected", "version": "902"}, {"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3565506"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-15", "description": "CWE-15: External Control of System or Configuration Setting"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-01-13T01:13:20.999Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0495", "state": "PUBLISHED", "dateUpdated": "2026-01-13T15:15:41.236Z", "dateReserved": "2025-12-09T22:06:37.539Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-01-13T01:13:20.999Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Fiori App (Intercompany Balance Reconciliation)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "UIAPFI70 500"}, {"status": "affected", "version": "600"}, {"status": "affected", "version": "700"}, {"status": "affected", "version": "800"}, {"status": "affected", "version": "900"}, {"status": "affected", "version": "901"}, {"status": "affected", "version": "902"}, {"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application."}, {"lang": "es", "value": "La aplicaci\u00f3n SAP Fiori Intercompany Balance Reconciliation permite a un atacante con altos privilegios enviar archivos cargados a correos electr\u00f3nicos arbitrarios, lo que podr\u00eda facilitar campa\u00f1as de phishing efectivas. Esto tiene un impacto bajo en la confidencialidad, integridad y disponibilidad de la aplicaci\u00f3n."}], "id": "CVE-2026-0495", "lastModified": "2026-06-17T10:10:50.640", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.7, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0495", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T15:15:35.824019Z", "version": "2.0.3"}}]}, "published": "2026-01-13T02:15:51.830", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3565506"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-15"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:51:31.156341+00:00", "value": {"mitigation_remediation": ["Install the latest SAP security update or technical note that resolves the file upload email sending flaw.", "Restrict high\u2011privilege user accounts to the minimal required permissions for the Fiori App, reducing the ability to abuse the upload feature.", "Configure email monitoring tools to detect and flag suspicious attachments sent from the Fiori App to identify potential phishing campaigns."], "summary": {"action": "Patch", "impact": "Phishing via arbitrary email sending"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the SAP Fiori App for Intercompany Balance Reconciliation from SAP SE. No specific product versions are listed, so any current deployment of this application may be vulnerable until an official update or patch is applied.", "description_and_impact": "The SAP Fiori App for Intercompany Balance Reconciliation allows high\u2011privileged users to upload files and send them to any email address that the application can reach, effectively turning the application into a tool for delivering malicious content or phishing messages. Although the reported impact on confidentiality, integrity and availability is low, the ability to produce deceptive attachments or credentials constitutes a significant threat. The flaw is a case of improper authorization (CWE\u201115) that lets privileged users bypass normal email sending restrictions.", "risk_and_exploitability": "With a CVSS score of 5.1 and an EPSS score of less than 1\u202f%, the risk level is moderate and the likelihood of exploitation is low but not zero. The CVE is not listed in the CISA Knowledge Exploited Vulnerabilities catalog, and no publicly known exploits are reported. Because the attack requires high\u2011privilege access to the Fiori application, it represents an internal attack vector; attackers could use the exposed file\u2011upload feature to send arbitrary attachments to arbitrary email addresses, enabling phishing campaigns against internal or external recipients."}}}}, "created": "2026-01-13T09:26:56.811227+00:00", "updated": "2026-04-18T07:00:11.344975+00:00", "vendors": ["sap", "sap$PRODUCT$fiori"]}