FrançaisShown in its original language — a full translation is planned for a future version.
Multiples vulnérabilités dans les produits SAP
view advisory published 2026-10-13
A published security advisory; the vulnerabilities below are the ones it describes.
01
describes (22)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-89124US | medium4.3OT elevated | — | ||
Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privil… | ||||
| CVE-2026-89122US | medium6.1 | — | ||
SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a… | ||||
| CVE-2026-89121US | medium4.7OT elevated | — | ||
SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges… | ||||
| CVE-2026-89120US | high7.1OT elevated | — | ||
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, incl… | ||||
| CVE-2026-89118US | medium5.3 | — | ||
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Co… | ||||
| CVE-2026-89117US | medium6.1 | — | ||
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed i… | ||||
| CVE-2026-89116US | medium5.9 | — | ||
The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the… | ||||
| CVE-2026-89113US | high8.8 | — | ||
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted re… | ||||
| CVE-2026-89112US | medium6.5OT elevated | — | ||
The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an org… | ||||
| CVE-2026-89111US | critical10.0 | — | ||
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAu… | ||||
| CVE-2026-89110US | critical9.9 | — | ||
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on… | ||||
| CVE-2026-89108US | critical9.1OT elevated | — | ||
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrato… | ||||
| CVE-2026-89107US | critical9.9 | — | ||
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting languag… | ||||
| CVE-2026-89106US | medium4.4 | — | ||
SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in… | ||||
| CVE-2026-89105US | medium4.2OT elevated | — | ||
The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauth… | ||||
| CVE-2026-76976US | medium5.4 | — | ||
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticat… | ||||
| CVE-2026-76975US | medium6.1 | — | ||
Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user a… | ||||
| CVE-2026-76972US | medium6.5 | — | ||
Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the applica… | ||||
| CVE-2026-58249US | high7.5 | Exploit | ||
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker co… | ||||
| CVE-2026-58242US | low3.5 | — | ||
SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the at… | ||||
showing 20 of 22
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan