← Back

CVE-2026-24314

nvd nist
Published: Feb 24, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: CNA (Secondary)

Description

Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.

Affected (7)

Sap
2 products
S/4hana Uiapfi70
S/4hana Uis4h
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Sap
S/4hana Uiapfi70
Version 600
S/4hana Uiapfi70
Version 700
S/4hana Uiapfi70
Version 800
S/4hana Uiapfi70
Version 900
S/4hana Uiapfi70
Version 901
S/4hana Uiapfi70
Version 902
S/4hana Uis4h
Version 109

Related CWEs

CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

References (2)

Source: cna@sap.com
Permissions Required
Source: cna@sap.com
Vendor Advisory

Timeline

No history available yet.