CVE-2026-40132: CWE-862: Missing Authorization in SAP_SE SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)
CVE-2026-40132 is a medium severity vulnerability in SAP Strategic Enterprise Management's Balanced Scorecard Wizard. It involves a missing authorization check that allows an authenticated attacker to access unauthorized information and modify default settings and value fields. This manipulation can mislead risk evaluations and falsely lower assessed risk levels. The vulnerability impacts confidentiality and integrity to a low degree but does not affect application availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-40132) in SAP Strategic Enterprise Management (SEM) Balanced Scorecard Wizard arises from a missing authorization check. Authenticated users with limited privileges can access data they should not see and alter configuration settings and value fields. These unauthorized changes can distort risk assessments by lowering risk levels inaccurately. The affected versions include SEM-BW 605 and versions 700 through 800. The CVSS 3.1 base score is 5.4 (medium severity), reflecting low confidentiality and integrity impacts and no availability impact. No vendor-provided patch or official remediation level is currently documented.
Potential Impact
The vulnerability allows unauthorized read and write access to sensitive configuration and data within the Balanced Scorecard Wizard, potentially leading to misleading risk evaluations. The confidentiality and integrity of the data are impacted at a low level, while availability remains unaffected. This could result in business decisions based on inaccurate risk information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected SAP SEM Balanced Scorecard Wizard to trusted users only and review user permissions carefully to limit exposure. Monitor for any unusual changes in risk evaluation settings.
CVE-2026-40132: CWE-862: Missing Authorization in SAP_SE SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)
Description
CVE-2026-40132 is a medium severity vulnerability in SAP Strategic Enterprise Management's Balanced Scorecard Wizard. It involves a missing authorization check that allows an authenticated attacker to access unauthorized information and modify default settings and value fields. This manipulation can mislead risk evaluations and falsely lower assessed risk levels. The vulnerability impacts confidentiality and integrity to a low degree but does not affect application availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVSS v3.1
Score 5.4medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-40132) in SAP Strategic Enterprise Management (SEM) Balanced Scorecard Wizard arises from a missing authorization check. Authenticated users with limited privileges can access data they should not see and alter configuration settings and value fields. These unauthorized changes can distort risk assessments by lowering risk levels inaccurately. The affected versions include SEM-BW 605 and versions 700 through 800. The CVSS 3.1 base score is 5.4 (medium severity), reflecting low confidentiality and integrity impacts and no availability impact. No vendor-provided patch or official remediation level is currently documented.
Potential Impact
The vulnerability allows unauthorized read and write access to sensitive configuration and data within the Balanced Scorecard Wizard, potentially leading to misleading risk evaluations. The confidentiality and integrity of the data are impacted at a low level, while availability remains unaffected. This could result in business decisions based on inaccurate risk information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected SAP SEM Balanced Scorecard Wizard to trusted users only and review user permissions carefully to limit exposure. Monitor for any unusual changes in risk evaluation settings.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- sap
- Date Reserved
- 2026-04-09T17:29:44.663Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0295aecbff5d8610902bd9
Added to database: 05/12/2026, 02:51:26 UTC
Last enriched: 05/19/2026, 10:59:22 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 96
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.