CVE-2026-76963Medium· 4.3▾ SunlitDue to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could res…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.3%
Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-89121Medium· 4.7SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data
CVE-2026-89112Medium· 6.5The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privilege…
CVE-2026-89108Critical· 9.1SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality
CVE-2026-76962Medium· 4.3SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality
CVE-2026-89124Medium· 4.3Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their in…
CVE-2026-89122Medium· 6.1SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component