CVE-2026-24326

Опубликовано: 10 фев. 2026

Источник: nvd

CVSS3: 4.3

EPSS Низкий

Описание

Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-enabled function modules to do direct update on standard SAP database table . This results in low impact on integrity, with no impact on confidentiality or availability of the application.

Ссылки

https://me.sap.com/notes/3678009
Permissions Required
https://url.sap/sapsecuritypatchday
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sap:s\/4hana_defense_\&_security:600:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:603:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:604:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:605:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:606:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:616:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:617:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:618:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:619:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:800:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:801:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:802:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:803:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:804:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:805:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:806:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:807:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:808:*:*:*:*:*:*:*

cpe:2.3:a:sap:s\/4hana_defense_\&_security:809:*:*:*:*:*:*:*

EPSS

Процентиль: 10%

0.00198

Низкий

4.3 Medium

CVSS3

Дефекты

CWE-862

Связанные уязвимости

GHSA-43ph-2f3g-c5f6