VulnerabilityPublished 10 Feb 2026

CVE-2026-24312: SAP Business Workflow · Missing Authorization

Affects SAP Business WorkflowSource CVE Database V5

Not known to be exploited · CVSS 5.2 Medium.

Data as of 26 Oct 2026, 17:16 UTC

CVSS 3.1 base score

5.2Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: High
User Interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: High: The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable component that could affect component-wide settings and files.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 10 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
SAP_SESAP Business Workflow	Affected SAP_BASIS 752 – SAP_BASIS 816 8 affected builds	Fixed in–

AI-suggested

Apply SAP vendor patches promptly once they are released for the affected SAP_BASIS versions to address the missing authorization check.
Conduct a thorough review and tightening of role-based access controls (RBAC) within SAP Business Workflow to ensure that permissions are strictly segregated and least privilege principles are enforced.
Implement enhanced monitoring and logging of administrative actions within SAP workflows to detect unusual privilege escalations or unauthorized activity early.
Enforce multi-factor authentication (MFA) for all administrative accounts to reduce the risk of credential compromise.
Regularly audit SAP user roles and permissions to identify and remediate any excessive or unnecessary privileges.
Train SAP administrators and security teams on the risks of privilege escalation and the importance of strict authorization checks.
Consider network segmentation and limiting administrative access to SAP systems to trusted internal networks only.
Prepare incident response plans specific to SAP workflow integrity breaches to enable rapid containment and recovery.

Description

CVE-2026-24312 is a medium-severity vulnerability in SAP Business Workflow caused by a missing authorization check that allows an authenticated administrative user to escalate privileges by exploiting permissions from less sensitive functions. This flaw primarily impacts data integrity by enabling unauthorized high-privilege actions, while confidentiality and availability impacts are low or none. The vulnerability affects multiple SAP_BASIS versions from 7.52 through 8.16. Exploitation requires authenticated administrative privileges and some user interaction, limiting the attack scope. No known exploits are currently in the wild. European organizations using affected SAP versions could face risks of unauthorized data manipulation within critical business workflows. Mitigation involves applying vendor patches once available, reviewing and tightening role-based access controls, and monitoring administrative activities for suspicious privilege escalations. Countries with significant SAP enterprise deployments and critical industries relying on SAP workflows, such as Germany, France, and the UK, are most likely to be affected.

Impact

For European organizations, this vulnerability poses a significant risk to the integrity of business workflows managed through SAP Business Workflow. Unauthorized privilege escalation can lead to manipulation or corruption of critical business processes, potentially resulting in financial discrepancies, compliance violations, and operational disruptions. Although confidentiality and availability impacts are low, the integrity compromise can undermine trust in business data and processes, which is critical for sectors such as finance, manufacturing, and public administration. Given SAP's widespread use across Europe, especially in large enterprises and government entities, exploitation could facilitate fraud, unauthorized transactions, or sabotage of automated workflows. The requirement for authenticated administrative access limits external threat actors but raises concerns about insider threats or compromised administrative accounts. Organizations may also face regulatory scrutiny under GDPR if workflow manipulations lead to improper handling of personal data or reporting inaccuracies.

Summary

CVE-2026-24312 is a vulnerability identified in SAP Business Workflow, specifically within the SAP_BASIS component versions 7.52 through 8.16. The root cause is a missing authorization check (CWE-862) that allows an authenticated administrative user to bypass role restrictions. This bypass occurs because the system erroneously allows permissions granted for less sensitive functions to be leveraged to perform unauthorized, high-privilege actions. The vulnerability does not affect confidentiality significantly and has no impact on availability, but it has a high impact on data integrity, as unauthorized changes to workflows or business processes can occur. The CVSS 3.1 base score is 5.2 (medium severity), reflecting that exploitation requires network access, low attack complexity, high privileges, and user interaction. The scope remains unchanged, meaning the vulnerability affects only the component where it exists. No public exploits are known at this time, but the flaw could be exploited by insiders or attackers who have gained administrative access to escalate privileges further and manipulate critical business workflows. The vulnerability highlights the importance of robust authorization checks in complex enterprise applications like SAP to prevent privilege escalation and unauthorized actions within business-critical processes.

CWE-862Missing Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #4OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
OWASP Cheat Sheets
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.8 (opens in a new tab)
V13.4.2 (opens in a new tab)
V7.2.2 (opens in a new tab)
Attack patterns
Exploitation of Thunderbolt Protection Flaws (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 17 Feb 2026, 09:38 UTC

WeaknessesCWE-862

Technical details

References

Community reviews

Related threats