Vulnerability details
CVE-2026-34256
SAP_SE SAP ERP and SAP S/4 HANA
Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)
CVSS 3.1
7.1High
Official description
Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any existing eight?character executable ABAP report without authorization. If the overwritten report is subsequently executed, the intended functionality could become unavailable. Successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 3.1 | CVEProject cvelistV5 (CNA) (sap) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 103 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 104 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 105 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 106 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 107 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 108 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 109 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 602 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 603 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 604 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 605 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 606 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 700 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 720 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | 730 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | EA-APPL 600 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | EA-FIN 617 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | S4CORE 102 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | SAPSCORE 135 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) | SAP_FIN 618 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-14
- Last updated
- 2026-04-14
- State
- Published
- Assigner (CNA)
- sap
Exploit prediction (EPSS)
0.22%
Probability of exploitation in 30 days
12.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-862Missing Authorization