Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes, potentially disrupting request processing and causing denial of service. This results in low impact on integrity and high impact on availability, while confidentiality remains unaffected.
CVE-2026-27685 is a critical deserialization vulnerability in SAP NetWeaver Enterprise Portal Administration (EP-RUNTIME 7.50). It arises when a privileged user uploads untrusted or malicious serialized content, which upon deserialization can compromise confidentiality, integrity, and availability of the host system. The vulnerability requires high privileges but no user interaction and can be exploited remotely over the network. It has a CVSS score of 9.1, indicating severe impact with potential for complete system compromise and cross-system effects. No known exploits are currently reported in the wild. Organizations using SAP NetWeaver Enterprise Portal 7.50 should prioritize patching or mitigating this flaw to prevent potential attacks. This vulnerability primarily affects enterprises relying on SAP's portal technology, especially in sectors with critical SAP deployments.
SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacker to inject arbitrary SQL code through user-controlled input fields. The application concatenates these inputs directly into SQL queries without proper validation or escaping. As a result, an attacker can manipulate the WHERE clause logic and potentially gain unauthorized access to or modify database information. This vulnerability has no impact on integrity and low impact on the confidentiality and availability of the application.
CVE-2026-24317 is a medium severity vulnerability in SAP GUI for Windows with active GuiXT, involving uncontrolled search path element (CWE-427). An unauthenticated attacker can exploit this by tricking a user into placing a malicious DLL in a directory from which SAP GUI loads DLLs, leading to code execution in the user's context. Exploitation requires user interaction and has a low impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild. The vulnerability affects SAP GUI version BC-FES-GUI 8.00. Organizations using SAP GUI with GuiXT enabled should be cautious and implement mitigations to prevent DLL hijacking attacks.
SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF). Successful exploitation could lead to interaction with potentially sensitive internal endpoints, resulting in a low impact on data confidentiality and integrity. There is no impact on availability of the application.
SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing system information to be disclosed. This vulnerability has a low impact on confidentiality and does not affect integrity or availability.
The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur without validation. Such changes could affect system behaviour during startup, resulting in a high impact on the application's confidentiality and integrity, with a low impact on availability.
Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and read the sensitive information from database catalog of the ABAP system. This vulnerability has low impact on the application's confidentiality with no effect on the integrity and availability.
Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify or insert entries into the database configuration table of the ABAP system. This unauthorized content change could lead to reduced system performance or interruptions. The vulnerability has low impact on the application's integrity and availability, with no effect on confidentiality.
Due to insufficient validation of user-controlled input in the URLs query parameter. SAP Business One Job Service could allow an unauthenticated attacker to inject specially crafted input which upon user interaction could result in a DOM-based Cross-Site Scripting (XSS) vulnerability. This issue had a low impact on the confidentiality and integrity of the application with no impact on availability.
Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.
CVE-2026-24328 is a medium-severity vulnerability in the SAP Business Server Pages Application (TAF_APPLAUNCHER) that allows unauthenticated attackers to craft malicious URLs causing victims to be redirected to attacker-controlled sites. This URL redirection flaw (CWE-601) requires user interaction (clicking the link) and can lead to limited confidentiality and integrity impacts by exposing or altering sensitive information in the victim's browser context. There is no impact on application availability. The vulnerability affects specific versions of SAP ST-PI components and has a CVSS score of 6.1. No known exploits are currently reported in the wild. European organizations using affected SAP versions should prioritize patching and implement strict URL validation and user awareness to mitigate risks. Countries with significant SAP enterprise deployments and critical infrastructure relying on SAP are most likely to be impacted.
CVE-2026-24327 is a medium-severity vulnerability in SAP Strategic Enterprise Management's Balanced Scorecard BSP application caused by a missing authorization check. An authenticated attacker with legitimate access could view information they are not authorized to see, impacting confidentiality with no effect on integrity or availability. The vulnerability affects multiple versions of the SEM-BW product line. Exploitation requires network access and low complexity but does not require user interaction. No known exploits are currently in the wild. European organizations using affected SAP SEM versions may face risks of unauthorized data disclosure. Mitigation involves applying SAP patches when available, reviewing and tightening authorization roles, and monitoring access logs for suspicious activity. Countries with significant SAP enterprise deployments and critical industries relying on SAP SEM, such as Germany, France, and the UK, are most likely affected.
CVE-2026-24326 is a medium-severity vulnerability in SAP S/4HANA Defense & Security (Disconnected Operations) caused by a missing authorization check. An attacker with valid user privileges can invoke remote-enabled function modules to directly update standard SAP database tables without proper authorization. This flaw impacts data integrity but does not affect confidentiality or availability. The vulnerability affects multiple versions of SAP S/4HANA Defense & Security, from EA-DFPS 600 through 809. Exploitation requires network access and valid user credentials but no user interaction. No known exploits are currently reported in the wild. European organizations using affected SAP modules, especially in defense and security sectors, should prioritize patching and access control reviews. Countries with significant SAP deployments and strategic defense industries, such as Germany and France, are most likely impacted. Mitigation involves implementing strict role-based access controls, monitoring for unusual database modifications, and applying vendor patches once available. Overall, the vulnerability poses a moderate risk due to its limited impact scope and exploitation prerequisites.
CVE-2026-24325 is a stored Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise Central Management Console. It arises from improper encoding of user-controlled inputs, allowing an authenticated admin user to inject malicious JavaScript that executes when other users visit the compromised page. The vulnerability impacts confidentiality and integrity to a limited extent but does not affect availability. Exploitation requires high privileges and user interaction, limiting its ease of exploitation. No known exploits are currently reported in the wild. The vulnerability affects versions ENTERPRISE 430, 2025, and 2027 of the product. The CVSS score is 4.8 (medium severity). European organizations using SAP BusinessObjects Enterprise, especially in countries with significant SAP deployments, should prioritize patching and input validation controls to mitigate risk.
CVE-2026-24324 is a medium severity vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools) that allows an authenticated user with standard privileges to execute a crafted query causing the Content Management Server (CMS) to crash. This results in a denial of service condition affecting system availability, while confidentiality and integrity remain intact. Exploitation requires no user interaction but does require valid user credentials. The vulnerability affects versions ENTERPRISE 430, 2025, and 2027 of the platform. No known exploits are currently reported in the wild. The CVSS score is 6.5, reflecting a network attack vector with low complexity and no privileges beyond user level. European organizations relying on SAP BusinessObjects for business intelligence and reporting could face operational disruptions if targeted. Mitigation involves monitoring user activities, restricting access to AdminTools, and applying patches or vendor guidance once available. Countries with significant SAP deployments and critical industries using SAP BI platforms, such as Germany, France, and the UK, are most likely to be impacted.
CVE-2026-24323 is a medium severity vulnerability in the SAP Document Management System that allows unauthenticated attackers to perform URL redirection to untrusted sites via insufficiently sanitized URL parameters. This vulnerability enables injection of malicious scripts that execute in victims' browsers when they access crafted URLs, impacting confidentiality and integrity with no effect on availability. Exploitation requires user interaction but no authentication, and the vulnerability affects multiple SAP_APPL and S4CORE versions widely used in enterprise environments. There are no known exploits in the wild yet, and no patches have been published at the time of disclosure. European organizations using affected SAP versions are at risk of targeted phishing or social engineering attacks leveraging this flaw. Mitigation involves careful input validation, user awareness, and monitoring for suspicious URL usage. Countries with significant SAP enterprise deployments and critical infrastructure relying on SAP systems are most likely to be impacted.
CVE-2026-24322 is a high-severity vulnerability in the SAP Solution Tools Plug-In (ST-PI) that results from missing authorization checks in a function module. Authenticated users with low privileges can exploit this flaw to access sensitive information without proper permissions. The vulnerability impacts confidentiality but does not affect data integrity or system availability. It affects multiple versions of ST-PI, including 2008_1_700, 2008_1_710, 740, and 758. The CVSS score of 7.7 reflects the ease of exploitation over the network with low privileges and no user interaction required. No known exploits are currently reported in the wild. European organizations using affected SAP versions are at risk of sensitive data disclosure, which could lead to compliance violations and reputational damage. Mitigation requires applying vendor patches once available or implementing strict access controls and monitoring for unusual access patterns. Countries with significant SAP deployments and critical industries relying on SAP ERP systems are more likely to be targeted.
CVE-2026-24321 is a medium-severity vulnerability in SAP Commerce Cloud that allows unauthenticated users to access multiple API endpoints exposing sensitive personal information. The flaw stems from improperly secured APIs that do not require authentication, enabling attackers to retrieve data not intended for public access. While the vulnerability impacts confidentiality, it does not affect data integrity or system availability. The CVSS score of 5.3 reflects the ease of exploitation without authentication and the limited confidentiality impact. No known exploits are currently reported in the wild. European organizations using affected SAP Commerce Cloud versions (HY_COM 2205, COM_CLOUD 2211, 2211-JDK21) should prioritize reviewing API exposure and applying vendor patches or mitigations once available. Countries with significant SAP Commerce Cloud deployments and critical e-commerce infrastructure are at higher risk. Mitigation should focus on restricting API access, implementing strong authentication, and monitoring for unusual API requests.
CVE-2026-24320 is a low-severity vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) caused by improper neutralization of CRLF sequences in HTTP headers, leading to memory corruption and potential leakage of memory content. The flaw arises from logical errors in memory management when processing specially crafted input containing unique characters. Exploitation requires an authenticated attacker with low privileges and does not require user interaction. The vulnerability impacts confidentiality slightly but does not affect integrity or availability. No known exploits are currently reported in the wild. Multiple versions of SAP NetWeaver and ABAP Platform, including widely used releases, are affected. European organizations using these SAP products should assess their exposure and apply mitigations promptly. Due to the low CVSS score (3.1) and limited impact, the threat is not critical but still warrants attention to prevent information disclosure. Countries with significant SAP enterprise deployments, such as Germany and the UK, are most likely to be affected.
