CVE-2026-76974 is a vulnerability in SAP Fiori Launchpad where insufficient validation of user-controlled input allows an unauthenticated attacker to craft malicious links. When an authenticated user clicks such a link, their browser may load attacker-controlled content from an external source. This can lead to exfiltration of sensitive information from the user's session, impacting confidentiality. There is no impact on integrity or availability.
CVE-2026-76977 is a medium severity vulnerability in SAP UI5's Frame Options Allowlist. The issue arises from insufficient validation of the parent frame's origin against the configured allowlist, allowing an unauthenticated attacker to host a malicious page that can bypass framing restrictions. If an authenticated user visits the attacker's page and interacts with it, the attacker could trick the user into performing unintended actions. The impact is limited to integrity with no confidentiality or availability impact.
CVE-2026-76971 is a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence version 15.5. It allows an attacker with limited privileges and requiring user interaction to cause the server to make arbitrary outbound requests. This behavior can be combined with XML/XSL processing to execute scripts. The impact on confidentiality, integrity, and availability is considered low. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity.
CVE-2026-76969 is a critical vulnerability in the SAP Cloud Application Programming Model (CAP) affecting the @sap/cds-mtxs NPM library. The flaw involves insufficient protection of credentials in multitenant CAP applications with extensibility enabled. An unauthenticated attacker can exploit this by sending crafted requests to obtain sensitive credentials, potentially replacing or deleting tenant data. This leads to a high impact on the availability and integrity of the application, with some confidentiality impact on business data.
CVE-2026-76968 is a vulnerability in SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server that allows an authenticated low-privileged attacker to access certain administrative functions or interfaces. This leads to the disclosure of sensitive system information about the system state. The vulnerability impacts confidentiality but does not affect integrity or availability. It has a medium severity with a CVSS score of 6.5. No known exploits are reported in the wild, and no patch information is provided.
CVE-2026-76967 is a deserialization vulnerability in SAP NetWeaver Business Client version 8.10. The application does not sufficiently validate certain locally stored data during startup, allowing a low-privileged local attacker to replace this data with crafted content. When the application is launched, this crafted content can be processed, potentially leading to arbitrary code execution with the user's privileges. This vulnerability impacts confidentiality, integrity, and availability of the application and is rated with a high severity score of 7.8.
CVE-2026-76963 is a vulnerability in SAP NetWeaver and ABAP Platform caused by a missing authorization check in the Application Server ABAP. An authenticated attacker could exploit this to gain unauthorized access to sensitive system configuration information. The impact is limited to confidentiality with no effect on integrity or availability. The vulnerability has a medium severity rating with a CVSS score of 4.3. No affected versions or patch information are provided.
CVE-2026-76962 is a vulnerability in the SAP S/4HANA Manage Bank Chains app where insufficient authorization checks allow a low-privileged attacker to delete certain entries they should not access. This flaw impacts availability with no effect on confidentiality or integrity. The vulnerability affects SAP S/4HANA versions 108 and 109 and has a medium severity rating with a CVSS score of 4.3.
CVE-2026-76961 is a Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA Finance for Advanced Payment Management. The product does not sufficiently protect certain requests against CSRF attacks. An attacker with low privileges could craft a malicious link or page that, if visited by an authenticated user, could trigger unintended actions on the server. The impact is limited to a low confidentiality and integrity impact, with no availability impact.
CVE-2026-76960 is a Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA Finance for Advanced Payment Management. The product does not sufficiently protect certain requests against CSRF attacks, allowing an attacker with low privileges to craft malicious links or pages. If an authenticated user interacts with these, unintended actions could be executed on their behalf. The impact is limited to low confidentiality and integrity effects, with no availability impact. The vulnerability affects versions 106 and 107 of the product. The CVSS score is 3.5, indicating low severity.
CVE-2026-76959 is a Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA Finance for Advanced Payment Management. The product does not sufficiently protect certain requests against CSRF attacks, allowing an attacker with low privileges to craft malicious links or pages. If an authenticated user interacts with these, unintended actions may be executed on their behalf. The impact is limited to confidentiality and integrity with no availability impact. The CVSS score is 4.6, indicating medium severity. Affected versions are SAP S/4HANA Finance Advanced Payment Management versions 900, 901, and 902. There is no information about available patches or vendor advisories. No known exploits in the wild have been reported.
CVE-2026-76958 is an XML External Entity (XXE) vulnerability in SAP Integration Suite where XML documents from untrusted sources are not sufficiently validated. An attacker with low privileges can submit crafted XML payloads to read sensitive files on the server, impacting confidentiality. The vulnerability may also cause resource exhaustion, affecting availability. There is no impact on data integrity.
CVE-2026-66768 is a critical vulnerability in SAP NetWeaver's SAP GUI for Java where the trust level policy is not properly enforced for certain functions invoked from a connected backend system. This flaw allows a low-privileged attacker who can manipulate the backend system to execute arbitrary commands on the victim's machine. The vulnerability impacts confidentiality, integrity, and availability of the affected system.
CVE-2026-66767 is an integer underflow vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform. It allows an unauthenticated attacker to send a specially crafted packet that causes reprocessing of a previously buffered user request. This can potentially lead to session hijacking under narrow timing conditions. The vulnerability impacts confidentiality and integrity with high severity and has a low impact on availability.
CVE-2026-58240 is a critical vulnerability in SAP NetWeaver Message Server versions 9.18, 9.19, and 9.20. The issue arises from insufficient validation of internal application server components during registration, allowing an unauthenticated attacker with network access to register unauthorized components. This can lead to unauthorized actions within the application environment, severely impacting confidentiality, integrity, and availability.
CVE-2026-58234 is a vulnerability in SAP Process Integration (SOAP Adapter) involving improper restriction of recursive entity references in DTDs, also known as XML Entity Expansion. A privileged user can send specially crafted requests with deeply nested entity definitions that may temporarily increase processor load and degrade system responsiveness. The impact is limited to availability with no effect on confidentiality or integrity. The CVSS score is low (2.2). No affected versions or patch information are provided.
CVE-2026-44766 is a medium severity vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation) that allows a low-privileged authenticated user to perform SQL injection by injecting malicious input into certain functions. This flaw can lead to unauthorized access to sensitive information, impacting confidentiality without affecting integrity or availability.