CVE-2026-34256

CVE Enrichment

CVSS: 7.1 HIGH
EPSS: 0.22%
EPSS Percentile: 12.78%
CISA KEV: Not listed

Description

Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any existing eight?character executable ABAP report without authorization. If the overwritten report is subsequently executed, the intended functionality could become unavailable. Successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 14-Apr-2026 08:16
Last Modified: 27-Oct-2026 04:10
EPSS Date: 2026-11-05
CWE: CWE-862

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:N /
                            I:L /
                            A:H

CNA Products / Version Status

SAP_SE · SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) Source: CNA · [email protected]
Default status: unaffected

SAP_FIN 618 — affected
720 — affected
730 — affected
EA-FIN 617 — affected
700 — affected
SAPSCORE 135 — affected
S4CORE 102 — affected
103 — affected
104 — affected
105 — affected
106 — affected
107 — affected
108 — affected
109 — affected
EA-APPL 600 — affected
602 — affected
603 — affected
604 — affected
605 — affected
606 — affected

References

Last enrichment sync: 06-Nov-2026 09:43
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Tracked as CVE-2026-34256, it could be exploited to execute an ABAP program and rewrite existing eight‑character executable programs. SAP’s April 2026 Security Updates Fix Critical ABAP SQL Injection

CVE (1)

People (1)

Vendors (1)

Products (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.