CVE-2025-26658

mediumpriority · track · 0OT risk · elevatedEPSS 0.003 · 22 %ileDEEUNLRU
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.29% (22nd) EPSS
CVSS 6.8 · medium
Is it mine?
124 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unauthorized actions. Due to the improper session management, the attackers can elevate themselves to higher privilege and can read, modify and/or write new data. To gain authenticated sessions of other users, the attacker must invest considerable time and effort. This vulnerability has a high impact on the confidentiality and integrity of the application with no effect on the availability of the application.

01

cvss

Technical severity, 0–10. One row per scoring source.

6.8
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.8mediumAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU
v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU
v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · cna@sap.comexploitability 1.6 · impact 5.2
v3.16.2mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · NCSC-NL NL
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-384USCWE-384USCWE-384USCWE-862US
04

affected products (124)

Products and version ranges known to be affected.

showing 20 of 124
05

advisories (2)

Vendor and ecosystem advisories describing this.

  • NCSC-2025-0076Kwetsbaarheden verholpen in SAP softwareNL2025-03-11csaf · ncsc_nlNL

    SAP heeft meerdere kwetsbaarheden verholpen in zijn softwarecomponenten, waaronder SAP Commerce, SAP NetWeaver, en SAP BusinessObjects.

  • WID-SEC-W-2025-0521SAP Patchday März 2025: Mehrere SchwachstellenDeutsch2025-03-10csaf · cert_bundDE

    Ein Angreifer kann diese Schwachstellen ausnutzen, um erhöhte Privilegien zu erlangen, beliebigen Code auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundncsc_nlNVDCVE.orgMITRE
published 2025-03-11modified 2026-06-17
08

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan