CVE-2026-24326

Published: Feb 10, 2026Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: CNA (Secondary)

Description

Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-enabled function modules to do direct update on standard SAP database table . This results in low impact on integrity, with no impact on confidentiality or availability of the application.

Affected (19)

Products: Sap: S/4hana Defense & Security

Sap

1 product

S/4hana Defense & Security

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Sap S/4hana Defense & Security	Version 600
Sap S/4hana Defense & Security	Version 603
Sap S/4hana Defense & Security	Version 604
Sap S/4hana Defense & Security	Version 605
Sap S/4hana Defense & Security	Version 606
Sap S/4hana Defense & Security	Version 616
Sap S/4hana Defense & Security	Version 617
Sap S/4hana Defense & Security	Version 618
Sap S/4hana Defense & Security	Version 619
Sap S/4hana Defense & Security	Version 800
Sap S/4hana Defense & Security	Version 801
Sap S/4hana Defense & Security	Version 802
Sap S/4hana Defense & Security	Version 803
Sap S/4hana Defense & Security	Version 804
Sap S/4hana Defense & Security	Version 805
Sap S/4hana Defense & Security	Version 806
Sap S/4hana Defense & Security	Version 807
Sap S/4hana Defense & Security	Version 808
Sap S/4hana Defense & Security	Version 809

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://me.sap.com/notes/3678009

Source: cna@sap.com

Permissions Required

https://url.sap/sapsecuritypatchday

Source: cna@sap.com

Vendor Advisory

Timeline

No history available yet.