Due to missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal, a user with high privileges could access sensitive data belonging to another company. This vulnerability has a high impact on confidentiality and does not affect integrity and availability.
Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.
CVE-2026-27685 is a critical deserialization vulnerability in SAP NetWeaver Enterprise Portal Administration (EP-RUNTIME 7.50). It arises when a privileged user uploads untrusted or malicious serialized content, which upon deserialization can compromise confidentiality, integrity, and availability of the host system. The vulnerability requires high privileges but no user interaction and can be exploited remotely over the network. It has a CVSS score of 9.1, indicating severe impact with potential for complete system compromise and cross-system effects. No known exploits are currently reported in the wild. Organizations using SAP NetWeaver Enterprise Portal 7.50 should prioritize patching or mitigating this flaw to prevent potential attacks. This vulnerability primarily affects enterprises relying on SAP's portal technology, especially in sectors with critical SAP deployments.
SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacker to inject arbitrary SQL code through user-controlled input fields. The application concatenates these inputs directly into SQL queries without proper validation or escaping. As a result, an attacker can manipulate the WHERE clause logic and potentially gain unauthorized access to or modify database information. This vulnerability has no impact on integrity and low impact on the confidentiality and availability of the application.
CVE-2026-24317 is a medium severity vulnerability in SAP GUI for Windows with active GuiXT, involving uncontrolled search path element (CWE-427). An unauthenticated attacker can exploit this by tricking a user into placing a malicious DLL in a directory from which SAP GUI loads DLLs, leading to code execution in the user's context. Exploitation requires user interaction and has a low impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild. The vulnerability affects SAP GUI version BC-FES-GUI 8.00. Organizations using SAP GUI with GuiXT enabled should be cautious and implement mitigations to prevent DLL hijacking attacks.
SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF). Successful exploitation could lead to interaction with potentially sensitive internal endpoints, resulting in a low impact on data confidentiality and integrity. There is no impact on availability of the application.
SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing system information to be disclosed. This vulnerability has a low impact on confidentiality and does not affect integrity or availability.
The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.
Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and read the sensitive information from database catalog of the ABAP system. This vulnerability has low impact on the application's confidentiality with no effect on the integrity and availability.
Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify or insert entries into the database configuration table of the ABAP system. This unauthorized content change could lead to reduced system performance or interruptions. The vulnerability has low impact on the application's integrity and availability, with no effect on confidentiality.
Due to insufficient validation of user-controlled input in the URLs query parameter. SAP Business One Job Service could allow an unauthenticated attacker to inject specially crafted input which upon user interaction could result in a DOM-based Cross-Site Scripting (XSS) vulnerability. This issue had a low impact on the confidentiality and integrity of the application with no impact on availability.
Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.
A vulnerability was identified in SapneshNaik Student Management System up to f4b4f0928f0b5551a28ee81ae7e7fe47d9345318. This impacts an unknown function of the file index.php. Such manipulation of the argument Error leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-24328 is a medium-severity vulnerability in the SAP Business Server Pages Application (TAF_APPLAUNCHER) that allows unauthenticated attackers to craft malicious URLs causing victims to be redirected to attacker-controlled sites. This URL redirection flaw (CWE-601) requires user interaction (clicking the link) and can lead to limited confidentiality and integrity impacts by exposing or altering sensitive information in the victim's browser context. There is no impact on application availability. The vulnerability affects specific versions of SAP ST-PI components and has a CVSS score of 6.1. No known exploits are currently reported in the wild. European organizations using affected SAP versions should prioritize patching and implement strict URL validation and user awareness to mitigate risks. Countries with significant SAP enterprise deployments and critical infrastructure relying on SAP are most likely to be impacted.
CVE-2026-24327 is a medium-severity vulnerability in SAP Strategic Enterprise Management's Balanced Scorecard BSP application caused by a missing authorization check. An authenticated attacker with legitimate access could view information they are not authorized to see, impacting confidentiality with no effect on integrity or availability. The vulnerability affects multiple versions of the SEM-BW product line. Exploitation requires network access and low complexity but does not require user interaction. No known exploits are currently in the wild. European organizations using affected SAP SEM versions may face risks of unauthorized data disclosure. Mitigation involves applying SAP patches when available, reviewing and tightening authorization roles, and monitoring access logs for suspicious activity. Countries with significant SAP enterprise deployments and critical industries relying on SAP SEM, such as Germany, France, and the UK, are most likely affected.
CVE-2026-24326 is a medium-severity vulnerability in SAP S/4HANA Defense & Security (Disconnected Operations) caused by a missing authorization check. An attacker with valid user privileges can invoke remote-enabled function modules to directly update standard SAP database tables without proper authorization. This flaw impacts data integrity but does not affect confidentiality or availability. The vulnerability affects multiple versions of SAP S/4HANA Defense & Security, from EA-DFPS 600 through 809. Exploitation requires network access and valid user credentials but no user interaction. No known exploits are currently reported in the wild. European organizations using affected SAP modules, especially in defense and security sectors, should prioritize patching and access control reviews. Countries with significant SAP deployments and strategic defense industries, such as Germany and France, are most likely impacted. Mitigation involves implementing strict role-based access controls, monitoring for unusual database modifications, and applying vendor patches once available. Overall, the vulnerability poses a moderate risk due to its limited impact scope and exploitation prerequisites.
CVE-2026-24325 is a stored Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise Central Management Console. It arises from improper encoding of user-controlled inputs, allowing an authenticated admin user to inject malicious JavaScript that executes when other users visit the compromised page. The vulnerability impacts confidentiality and integrity to a limited extent but does not affect availability. Exploitation requires high privileges and user interaction, limiting its ease of exploitation. No known exploits are currently reported in the wild. The vulnerability affects versions ENTERPRISE 430, 2025, and 2027 of the product. The CVSS score is 4.8 (medium severity). European organizations using SAP BusinessObjects Enterprise, especially in countries with significant SAP deployments, should prioritize patching and input validation controls to mitigate risk.
CVE-2026-24324 is a medium severity vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools) that allows an authenticated user with standard privileges to execute a crafted query causing the Content Management Server (CMS) to crash. This results in a denial of service condition affecting system availability, while confidentiality and integrity remain intact. Exploitation requires no user interaction but does require valid user credentials. The vulnerability affects versions ENTERPRISE 430, 2025, and 2027 of the platform. No known exploits are currently reported in the wild. The CVSS score is 6.5, reflecting a network attack vector with low complexity and no privileges beyond user level. European organizations relying on SAP BusinessObjects for business intelligence and reporting could face operational disruptions if targeted. Mitigation involves monitoring user activities, restricting access to AdminTools, and applying patches or vendor guidance once available. Countries with significant SAP deployments and critical industries using SAP BI platforms, such as Germany, France, and the UK, are most likely to be impacted.
CVE-2026-24323 is a medium severity vulnerability in the SAP Document Management System that allows unauthenticated attackers to perform URL redirection to untrusted sites via insufficiently sanitized URL parameters. This vulnerability enables injection of malicious scripts that execute in victims' browsers when they access crafted URLs, impacting confidentiality and integrity with no effect on availability. Exploitation requires user interaction but no authentication, and the vulnerability affects multiple SAP_APPL and S4CORE versions widely used in enterprise environments. There are no known exploits in the wild yet, and no patches have been published at the time of disclosure. European organizations using affected SAP versions are at risk of targeted phishing or social engineering attacks leveraging this flaw. Mitigation involves careful input validation, user awareness, and monitoring for suspicious URL usage. Countries with significant SAP enterprise deployments and critical infrastructure relying on SAP systems are most likely to be impacted.
CVE-2026-24322 is a high-severity vulnerability in the SAP Solution Tools Plug-In (ST-PI) that results from missing authorization checks in a function module. Authenticated users with low privileges can exploit this flaw to access sensitive information without proper permissions. The vulnerability impacts confidentiality but does not affect data integrity or system availability. It affects multiple versions of ST-PI, including 2008_1_700, 2008_1_710, 740, and 758. The CVSS score of 7.7 reflects the ease of exploitation over the network with low privileges and no user interaction required. No known exploits are currently reported in the wild. European organizations using affected SAP versions are at risk of sensitive data disclosure, which could lead to compliance violations and reputational damage. Mitigation requires applying vendor patches once available or implementing strict access controls and monitoring for unusual access patterns. Countries with significant SAP deployments and critical industries relying on SAP ERP systems are more likely to be targeted.
