CVE-2026-24326
MEDIUM EPSS 9.8%
Published Feb 10, 20264mo ago · Modified Jun 17, 20261w ago
4.3 CVSS 3.1
Published Feb 10, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago
Description
Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-enabled function modules to do direct update on standard SAP database table . This results in low impact on integrity, with no impact on confidentiality or availability of the application.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
9.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-862 Missing Authorization Authorization
Affected Products 19
| Vendor | Product | Version | Range |
|---|---|---|---|
| sap | s\/4hana_defense_\&_security | 600 | any |
| sap | s\/4hana_defense_\&_security | 603 | any |
| sap | s\/4hana_defense_\&_security | 604 | any |
| sap | s\/4hana_defense_\&_security | 605 | any |
| sap | s\/4hana_defense_\&_security | 606 | any |
| sap | s\/4hana_defense_\&_security | 616 | any |
| sap | s\/4hana_defense_\&_security | 617 | any |
| sap | s\/4hana_defense_\&_security | 618 | any |
| sap | s\/4hana_defense_\&_security | 619 | any |
| sap | s\/4hana_defense_\&_security | 800 | any |
| sap | s\/4hana_defense_\&_security | 801 | any |
| sap | s\/4hana_defense_\&_security | 802 | any |
| sap | s\/4hana_defense_\&_security | 803 | any |
| sap | s\/4hana_defense_\&_security | 804 | any |
| sap | s\/4hana_defense_\&_security | 805 | any |
| sap | s\/4hana_defense_\&_security | 806 | any |
| sap | s\/4hana_defense_\&_security | 807 | any |
| sap | s\/4hana_defense_\&_security | 808 | any |
| sap | s\/4hana_defense_\&_security | 809 | any |
References 2
- me.sap.com https://me.sap.com/notes/3678009
- url.sap https://url.sap/sapsecuritypatchday
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.