CVE-2026-24314

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24314", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-01-21T22:15:25.361Z", "datePublished": "2026-02-24T05:23:52.911Z", "dateUpdated": "2026-02-24T16:44:18.533Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "S/4HANA (Manage Payment Media)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "UIAPFI70 600"}, {"status": "affected", "version": "700"}, {"status": "affected", "version": "800"}, {"status": "affected", "version": "900"}, {"status": "affected", "version": "901"}, {"status": "affected", "version": "902"}, {"status": "affected", "version": "UIS4H 109"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.</p>"}], "value": "Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-24T05:23:52.911Z"}, "references": [{"url": "https://me.sap.com/notes/3646297"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Information Disclosure vulnerability in S/4HANA (Manage Payment Media)", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T16:30:23.530917Z", "id": "CVE-2026-24314", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T16:44:18.533Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24314", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T16:30:23.530917Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T16:44:11.718Z"}}], "cna": {"title": "Information Disclosure vulnerability in S/4HANA (Manage Payment Media)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "S/4HANA (Manage Payment Media)", "versions": [{"status": "affected", "version": "UIAPFI70 600"}, {"status": "affected", "version": "700"}, {"status": "affected", "version": "800"}, {"status": "affected", "version": "900"}, {"status": "affected", "version": "901"}, {"status": "affected", "version": "902"}, {"status": "affected", "version": "UIS4H 109"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3646297"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.", "supportingMedia": [{"type": "text/html", "value": "<p>Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-497", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-24T05:23:52.911Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24314", "state": "PUBLISHED", "dateUpdated": "2026-02-24T16:44:18.533Z", "dateReserved": "2026-01-21T22:15:25.361Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-02-24T05:23:52.911Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "S/4HANA (Manage Payment Media)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "UIAPFI70 600"}, {"status": "affected", "version": "700"}, {"status": "affected", "version": "800"}, {"status": "affected", "version": "900"}, {"status": "affected", "version": "901"}, {"status": "affected", "version": "902"}, {"status": "affected", "version": "UIS4H 109"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:s\\/4hana_uiapfi70:600:*:*:*:*:*:*:*", "matchCriteriaId": "9AB97C06-5D56-470C-8B8F-3C782E1F70C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana_uiapfi70:700:*:*:*:*:*:*:*", "matchCriteriaId": "509D6CFA-7A14-428C-B878-9C9C1588ED8F", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana_uiapfi70:800:*:*:*:*:*:*:*", "matchCriteriaId": "06BDD6A0-C115-427B-876B-4F0C393043DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana_uiapfi70:900:*:*:*:*:*:*:*", "matchCriteriaId": "2C05B6F2-C6A8-4FEB-917A-AB2FA86B50BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana_uiapfi70:901:*:*:*:*:*:*:*", "matchCriteriaId": "186D3DCE-2FE0-4EB9-B9DB-EF7B5F0775E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana_uiapfi70:902:*:*:*:*:*:*:*", "matchCriteriaId": "64DFAF25-C968-40A5-96EA-4B163CA21897", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:s\\/4hana_uis4h:109:*:*:*:*:*:*:*", "matchCriteriaId": "F1C5F869-886A-4E07-81EB-B9DD4BE08180", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted."}, {"lang": "es", "value": "Bajo ciertas condiciones, SAP S/4HANA (Gestionar Medios de Pago) permite a un atacante autenticado acceder a informaci\u00f3n que de otro modo estar\u00eda restringida. Esto podr\u00eda causar un impacto bajo en la confidencialidad de la aplicaci\u00f3n, mientras que la integridad y la disponibilidad no se ven impactadas."}], "id": "CVE-2026-24314", "lastModified": "2026-06-17T10:22:53.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24314", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T16:30:23.530917Z", "version": "2.0.3"}}]}, "published": "2026-02-24T06:16:35.270", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3646297"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-497"}], "source": "cna@sap.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "UIAPFI70 600"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "700"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "800"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "900"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "901"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "902"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "UIS4H 109"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "S/4HANA (Manage Payment Media)", "source": "cna", "vendor": "SAP_SE"}, "product": "s/4hana_(manage_payment_media)", "vendor": "sap_se"}], "analysis": {"en": {"generated_at": "2026-04-17T15:50:23.907288+00:00", "value": {"mitigation_remediation": ["Apply the official SAP security patch as described in SAP Note 3646297 or the SAP Security Patch Day update.", "Restrict access to the Manage Payment Media application to only users with the appropriate authorization roles, ensuring that unauthorized accounts cannot authenticate to the feature.", "Monitor application logs for attempts to access restricted payment media data and investigate any anomalies."], "summary": {"action": "Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "SAP S/4HANA (Manage Payment Media) versions 600 through 902, as well as SAP S/4HANA UI for SAP HANA 109, are affected according to the Common Platform Enumeration entries. Only installations running these specific release levels without the vendor patch are vulnerable.", "description_and_impact": "The vulnerability allows an authenticated SAP S/4HANA user to read restricted payment media information that should otherwise be protected. This results in a small confidentiality disclosure to the attacker, with no impact on data integrity or availability. The weakness is categorized as CWE-497, reflecting improper authorization control.", "risk_and_exploitability": "The CVSS score of 4.3 indicates low overall risk, and the EPSS score of less than 1% suggests that exploitation attempts are very unlikely at present. Because the vulnerability requires a valid authenticated session, an attacker would need to compromise or obtain credentials for a legitimate user. The vulnerability is not listed in the CISA KEV catalog, further indicating lower threat priority, but patching remains recommended."}}}}, "created": "2026-02-24T09:52:56.965752+00:00", "updated": "2026-04-17T16:00:11.374806+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$s/4hana_(manage_payment_media)"]}