NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in SAP-producten
view advisory published 2026-04-14
SAP heeft kwetsbaarheden verholpen in verschillende SAP-producten, waaronder SAP Supplier Relationship Management, SAP BusinessObjects Business Intelligence Platform, SAP NetWeaver Application Server Java en ABAP, SAP Landscape Transformation, SAP Business Planning and Consolidation, SAP Business Warehouse, SAP Content Management en SAP Human Capital Management.
01
describes (18)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-27680US | medium4.3OT elevated | — | ||
Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page… | ||||
| CVE-2026-34264US | — | — | ||
During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could gues… | ||||
| CVE-2026-34262US | medium4.3 | — | ||
Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer | ||||
| CVE-2026-34261US | —OT elevated | — | ||
Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, p… | ||||
| CVE-2026-34257US | — | — | ||
Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be r… | ||||
| CVE-2026-34256US | —OT elevated | — | ||
Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any ex… | ||||
| CVE-2026-27683US | — | — | ||
SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs. When a victim accesses the URL,… | ||||
| CVE-2026-27681US | — | — | ||
Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, mo… | ||||
| CVE-2026-27679US | —OT elevated | — | ||
Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exposed OData se… | ||||
| CVE-2026-27678US | —OT elevated | — | ||
Due to missing authorization checks in the SAP S/4HANA backend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exposed OData ser… | ||||
| CVE-2026-27677US | —OT elevated | — | ||
Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Reference Equipment), an attacker could update and delete child entities via OData services without pro… | ||||
| CVE-2026-27676US | —OT elevated | — | ||
Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Technical Object Structures), an attacker could update and delete child entities via exposed OData serv… | ||||
| CVE-2026-27675US | — | — | ||
SAP Landscape Transformation contains a vulnerability in an RFC-exposed function module that could allow a high privileged adversary to inject arbitrary ABAP code and operating sys… | ||||
| CVE-2026-27674US | — | — | ||
Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the… | ||||
| CVE-2026-27673US | —OT elevated | — | ||
Due to a missing authorization check, SAP S/4HANA (Private Cloud and On-Premise) allows an authenticated user to delete files on the operating system and gain unauthorized control… | ||||
| CVE-2026-27672US | —OT elevated | — | ||
The Material Master application does not enforce authorization checks for authenticated users when executing reports, resulting in the disclosure of sensitive information. This vul… | ||||
| CVE-2026-24318US | — | — | ||
Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuse… | ||||
| CVE-2026-0512US | — | — | ||
Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL… | ||||
02
references
External citations — patches, advisories, analysis.
- Referenceexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan