CVE-2026-44743 is a vulnerability in SAP Business Objects where an unauthorized attacker can access a specific endpoint to leak sensitive system information. The impact is limited to confidentiality with no effect on integrity or availability. The vulnerability has a low severity rating and a CVSS score of 3.7. No official patch or remediation guidance has been provided yet. The affected versions explicitly include 2025 and 2027.
CVE-2026-40128 is a critical path traversal vulnerability in SAP NetWeaver Application Server Java (Web Container). It allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters. This manipulation enables the attacker to traverse directories and process arbitrary files on the local system. Successful exploitation could lead to viewing or modifying sensitive information or causing denial of service by making parts of the system unavailable.
CVE-2026-27671 is a critical stack-based buffer overflow vulnerability in the SAP Kernel used by SAP NetWeaver AS ABAP and ABAP Platform. An unauthenticated attacker can exploit improper RFC protocol validation by sending a crafted RFC request, causing memory corruption. This vulnerability impacts confidentiality, integrity, and availability of the affected application versions.
CVE-2026-24315 is a path traversal vulnerability in SAP Fiori Launchpad that allows attackers to craft malicious URLs triggering arbitrary service calls. Exploitation requires advanced system knowledge and user interaction. The vulnerability impacts confidentiality and integrity at a low level, with no effect on availability. The CVSS score is 4.2, indicating medium severity. No official patch or remediation guidance is currently available from the vendor.
The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic. Leading to low impact on confidentiality. Integrity and availability are unaffected.
Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, the injected CSS is executed. As a result, the issue has a low impact on confidentiality, while integrity and availability are not impacted.
CVE-2026-40137 is a medium severity vulnerability in SAP SE's Business Server Pages Application (TAF_APPLAUNCHER) that allows an unauthenticated attacker to craft malicious links. When victims click these links, they may be redirected to attacker-controlled sites, potentially exposing or altering sensitive information in the victim's browser. The vulnerability impacts confidentiality and integrity to a low degree but does not affect availability. It is related to improper neutralization of input during web page generation (CWE-79). No official patch or remediation guidance is currently available.
CVE-2026-40136 is a vulnerability in SAP Financial Consolidation (version FINANCE 1010) that allows an authenticated attacker to temporarily disconnect other users by terminating their sessions. This results in a temporary denial of service for those users but does not compromise the application itself. There is no impact on data confidentiality or integrity. The overall impact on availability is low, and the vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-40135 is an OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform. It allows an authenticated attacker with administrative privileges to execute crafted shell commands on the server while bypassing logging mechanisms. This can lead to unauthorized command execution impacting the integrity and availability of the application. There is no impact on confidentiality. The vulnerability affects multiple SAP_BASIS versions from 700 through 816. No patch or official remediation guidance is currently provided by the vendor. Exploits in the wild are not known at this time.
CVE-2026-40134 is a vulnerability in SAP Incentive and Commission Management caused by missing authorization checks. Authenticated users can invoke a remote-enabled function module to perform unauthorized table update operations. The vulnerability impacts data integrity but does not affect confidentiality or availability. It has a medium severity with a CVSS score of 4.3. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-40133 is a medium severity vulnerability in SAP S/4HANA Condition Maintenance caused by a missing authorization check. An authenticated attacker could view and modify condition table records without proper permissions, impacting confidentiality and integrity at a low level. The vulnerability may also disrupt legitimate user access to these records, causing a low impact on application availability. The affected versions include S4CORE 102 through 109. There is no vendor-provided patch or official remediation guidance available at this time, and no known exploits have been reported in the wild.
CVE-2026-40132 is a medium severity vulnerability in SAP Strategic Enterprise Management's Balanced Scorecard Wizard. It involves a missing authorization check that allows an authenticated attacker to access unauthorized information and modify default settings and value fields. This manipulation can mislead risk evaluations and falsely lower assessed risk levels. The vulnerability impacts confidentiality and integrity to a low degree but does not affect application availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-40131 is an SQL injection vulnerability in the SAP HANA Deployment Infrastructure (HDI) deploy library, specifically in the @sap/hdi-deploy package. The issue arises because SQL queries are dynamically constructed using user input without proper parameterization or prepared statements. Exploitation requires high privileged user access and could allow alteration of SELECT statements, impacting the confidentiality and availability of the application. There is no impact on data integrity. The vulnerability has a low CVSS score of 3.4 and currently no known exploits in the wild or official patches.
CVE-2026-40129 is a code injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform. An authenticated attacker can send specially crafted inputs that, when processed, may execute arbitrary code for other users subscribed to the affected channel. The vulnerability impacts the integrity of the system but does not affect confidentiality or availability. The CVSS score is 4.3, indicating a medium severity level. There is no confirmed patch or official remediation available at this time, and no known exploits have been reported in the wild.
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.
CVE-2026-34260 is a critical SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP) affecting multiple SAP_BASIS versions. An authenticated attacker can inject malicious SQL commands via user-controlled input that is concatenated directly into SQL queries without proper sanitization. Successful exploitation can lead to unauthorized disclosure of sensitive database information and application crashes, impacting confidentiality and availability. Integrity is not affected. No official patch or remediation guidance is currently confirmed.
CVE-2026-34259 is an OS command injection vulnerability in SAP Forecasting & Replenishment affecting versions SCM 702, 712, 713, and 714. An authenticated attacker with administrative privileges can exploit a non-remote-enabled function to execute arbitrary operating system commands. This could lead to full compromise of confidentiality, integrity, and availability by allowing reading or modification of system data or shutting down the system. The vulnerability has a high severity score of 8.2. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-34258 is a vulnerability in SAPUI5 (Search UI) that allows an unauthenticated attacker to manipulate URL parameters to inject malicious content. This can mislead users into clicking links that lead to attacker-controlled pages rendered by the application. The vulnerability impacts confidentiality to a low degree but does not affect integrity or availability. It has a medium severity with a CVSS score of 4.7. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-27682 is a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, specifically affecting applications based on Business Server Pages. An unauthenticated attacker can craft a malicious URL exploiting an unprotected parameter, causing execution of injected scripts in a victim's browser if the link is clicked. This vulnerability impacts the confidentiality and integrity of the affected application but does not affect availability. The vulnerability has a medium severity with a CVSS score of 4.7. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-0502 is a medium severity vulnerability in SAP BusinessObjects Business Intelligence Platform caused by insufficient Cross-Site Request Forgery (CSRF) protection. An authenticated user could be tricked into sending unintended requests to the web server. The vulnerability impacts the integrity and availability of the application to a low degree but does not affect data confidentiality. There is no known exploit in the wild and no official patch or remediation guidance has been provided yet.