CVE-2026-76960 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

CVE-2026-76960

SAP S/4HANA Finance (Advanced Payment Management) is affected by a Cross-Site Request Forgery (CSRF) vulnerability caused by insufficient CSRF protection on certain requests. An attacker with low privileges can craft a malicious link or page; when an authenticated victim interacts with it, uninte...

EUVD-2026-72580

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

EUVD-2026-72579

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

CVE-2026-76959 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

CVE-2026-76959 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

CVE-2026-76959

A Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA Finance (Advanced Payment Management) stems from insufficient CSRF protection on certain requests. An attacker with low privileges can craft a malicious link or page that, when interacted with by an authenticated victim, triggers un...

CVE-2026-76958 XML External Entity (XXE) Vulnerability in SAP Integration Suite

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

CVE-2026-76958 XML External Entity (XXE) Vulnerability in SAP Integration Suite

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

EUVD-2026-72578

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

CVE-2026-76958

SAP Integration Suite contains an XML External Entity (XXE) vulnerability in certain internal components that do not sufficiently validate XML documents accepted from untrusted sources. An attacker with low privileges can submit crafted XML payloads containing malicious external entity declaratio...

CVE-2026-66768

SAP GUI for Java (part of SAP NetWeaver) contains an Improper Access Control flaw where the trust level policy is not correctly enforced for certain functions invoked from a connected backend system. A low-privileged attacker can manipulate a connected backend to trigger affected functionality, e...

EUVD-2026-72577

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

CVE-2026-66768 Improper Access Control in SAP NetWeaver (SAP GUI for Java)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

CVE-2026-66768 Improper Access Control in SAP NetWeaver (SAP GUI for Java)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

CVE-2026-66767 Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

CVE-2026-66767 Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

EUVD-2026-72576

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

CVE-2026-66767

CVE-2026-66767 is a memory corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an unauthenticated user to send a specially crafted packet triggering reprocessing of a previously buffered user request , potentially hijacking another user's session un...

EUVD-2026-72575

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...