CVE-2026-0502 is a medium severity vulnerability in SAP BusinessObjects Business Intelligence Platform caused by insufficient Cross-Site Request Forgery (CSRF) protection. An authenticated user could be tricked into sending unintended requests to the web server. The vulnerability impacts the integrity and availability of the application to a low degree but does not affect data confidentiality. There is no known exploit in the wild and no official patch or remediation guidance has been provided yet.
CVE-2026-34264 is a vulnerability in SAP Human Capital Management for SAP S/4HANA where authorization checks return specific messages that allow an authenticated user with low privileges to infer and enumerate information beyond their authorized scope. This results in the disclosure of sensitive information, impacting confidentiality. Integrity and availability are not affected. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-34261 is a medium severity vulnerability in SAP Business Analytics and SAP Content Management caused by missing authorization checks. Authenticated users could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. The vulnerability impacts confidentiality but does not affect integrity or availability. It affects multiple versions of SAP products including S4HCMRXX 100, 101, 102 and SAP_HRRXX 600, 604, 608. There is no confirmed patch or official remediation available at this time, and no known exploits in the wild have been reported.
CVE-2026-34257 is an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP that allows an unauthenticated attacker to craft a malicious URL which, if visited by a victim, redirects them to an attacker-controlled site. This vulnerability impacts confidentiality and integrity at a low level and does not affect availability. It affects multiple SAP_BASIS versions from 700 through 816. The CVSS score is 6.1, indicating a medium severity. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.
CVE-2026-34256 is a high-severity vulnerability in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise) caused by a missing authorization check. An authenticated attacker can execute a specific ABAP report to overwrite any existing eight-character executable ABAP report without proper authorization. This can lead to the overwritten report becoming unavailable or altered in functionality when executed. The vulnerability impacts system availability significantly and has a limited impact on integrity confined to the affected report. Confidentiality is not affected. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.
CVE-2026-27683 is a cross-site scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform that allows an authenticated attacker to inject malicious JavaScript via crafted URLs. When a victim user accesses such a URL, the injected script executes in their browser, potentially exposing restricted information. The vulnerability impacts confidentiality to a low degree but does not affect integrity or availability. It requires user interaction and authenticated access. No official patch or remediation guidance is currently confirmed from the vendor. The vulnerability has a medium severity rating with a CVSS score of 4.1.
CVE-2026-27681 is a critical SQL injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse. It arises from insufficient authorization checks allowing an authenticated user to execute crafted SQL commands. This can lead to unauthorized reading, modification, and deletion of database data, severely impacting confidentiality, integrity, and availability. The vulnerability affects multiple versions of the products, including HANABPC 810, BPC4HANA 300, and SAP_BW versions 750 through 758 and 816. The CVSS score is 9.9, indicating a critical severity level. No official patch or remediation guidance is currently provided, and no known exploits in the wild have been reported. Organizations using the affected versions should monitor vendor advisories for updates and apply fixes once available.
CVE-2026-27679 is a vulnerability in the SAP S/4HANA frontend OData Service (Manage Reference Structures) caused by missing authorization checks. This flaw allows an attacker with some privileges to update and delete child entities via exposed OData services without proper authorization. The vulnerability impacts data integrity but does not affect confidentiality or availability. It has a medium severity rating with a CVSS score of 6.5. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-27678 is a vulnerability in the SAP S/4HANA backend OData Service (Manage Reference Structures) caused by missing authorization checks. This flaw allows an attacker with limited privileges to update and delete child entities through exposed OData services without proper authorization. The vulnerability impacts data integrity but does not affect confidentiality or availability. It has a CVSS score of 6.5, indicating medium severity. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.
CVE-2026-27677 is a vulnerability in the SAP S/4HANA OData Service (Manage Reference Equipment) caused by missing authorization checks. This flaw allows an attacker with limited privileges to update and delete child entities via the OData service without proper authorization. The vulnerability impacts data integrity but does not affect confidentiality or availability. It has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation guidance has been provided yet, and there are no known exploits in the wild. The affected version is S4CORE 109.
CVE-2026-27676 is a vulnerability in the SAP S/4HANA OData Service (Manage Technical Object Structures) caused by missing authorization checks. This flaw allows an attacker with limited privileges to update and delete child entities via exposed OData services without proper authorization. The impact is limited to integrity, with no effect on confidentiality or availability. The vulnerability has a medium severity rating with a CVSS score of 4.3. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.
CVE-2026-27675 is a vulnerability in SAP Landscape Transformation involving an RFC-exposed function module that allows a high privileged attacker to inject arbitrary ABAP code and operating system commands. The vulnerability impacts data integrity to a low degree, with no effect on confidentiality or availability. The CVSS score is low (2.0), reflecting the limited impact and the requirement for high privileges and user interaction. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-27674 is a code injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) version WD-RUNTIME 7.50. An unauthenticated attacker can supply crafted input that is interpreted by the application, causing it to reference attacker-controlled content. If a victim accesses the affected functionality, the attacker-controlled content could execute in the victim's browser, potentially compromising the session and allowing arbitrary client-side code execution. This impacts the confidentiality and integrity of the application but does not affect availability.
CVE-2026-27673 is a vulnerability in SAP S/4HANA (Private Cloud and On-Premise) caused by a missing authorization check. This flaw allows an authenticated user with low privileges to delete files on the operating system, leading to unauthorized control over file operations. The impact affects the integrity and availability of the application with no impact on confidentiality. The vulnerability has a medium severity with a CVSS score of 4.9. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-27672 is a vulnerability in the SAP SE Material Master application where authorization checks are missing for authenticated users executing reports. This flaw allows disclosure of sensitive information but does not impact system integrity or availability. The vulnerability affects multiple versions of S4CORE and SCM_BASIS products. The CVSS score is 4.3, indicating a medium severity level. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.
CVE-2026-24318 is an insecure session management vulnerability in SAP BusinessObjects Business Intelligence Platform. An unauthenticated attacker could obtain and reuse valid session tokens to impersonate a victim's authenticated session. This allows unauthorized access to or modification of information within the victim's session scope, affecting confidentiality and integrity. The vulnerability does not impact availability. It affects multiple versions including ENTERPRISE 430, 2025, and 2027. The CVSS score is 4.2, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-0512 is a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF Handler in SRM Catalog). An unauthenticated attacker can craft a malicious URL that, when accessed by a victim, executes malicious content in the victim's browser. This vulnerability impacts the confidentiality and integrity of the affected application but does not affect availability. It affects SAP SRM versions 702, 713, and 714. The vulnerability has a medium severity with a CVSS score of 6.1. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.
CVE-2026-27688 is a medium-severity vulnerability in SAP NetWeaver Application Server for ABAP caused by a missing authorization check in a specific RFC function module. An authenticated attacker with user privileges able to execute this function can read Database Analyzer Log Files, potentially exposing sensitive information. The vulnerability affects multiple SAP_BASIS versions from 700 through 816. While the confidentiality of data is impacted, system integrity and availability remain unaffected. Exploitation does not require user interaction but does require some level of authenticated privileges. No known exploits are currently reported in the wild. Organizations using affected SAP versions should prioritize applying patches or implementing compensating controls to restrict access to the vulnerable function module. Countries with significant SAP deployments and critical infrastructure relying on SAP systems are at higher risk. The CVSS score is 5.0, reflecting a medium severity level due to limited confidentiality impact and required privileges for exploitation.
