CVE-2026-76969

criticalpriority · track · 38EPSS 0.004 · 38 %ileNLUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.44% (38th) EPSS
CVSS 9.4 · critical
Is it mine?
24 products
Check your exposure
Who says so?
2 sources
ncsc_nl · osv

EPSS · scored 2026-10-27

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.

01

cvss

Technical severity, 0–10. One row per scoring source.

9.4
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.6–9.4

v3.19.4criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Hprimary · cna@sap.comexploitability 3.9 · impact 5.5
v3.19.4criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Hsecondary · OSV
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.19.4criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Hsecondary · NCSC-NL NL
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-522USCWE-522USCWE-522US
04

affected products (24)

Products and version ranges known to be affected.

showing 20 of 24
05

advisories (2)

Vendor and ecosystem advisories describing this.

  • NCSC-2026-0356Kwetsbaarheden verholpen in diverse SAP-productenNL2026-09-09csaf · ncsc_nlNL

    SAP heeft kwetsbaarheden verholpen in SAP Extended Passport Protocol (EPP) processing library, SAP NetWeaver Message Server, @sap/cds-mtxs NPM library, SAP GUI for Java, SAP ABAP Development Tools voor SAP NetWeaver AS ABAP, SAP Integration Suite, SAP NetWeaver Business Client, SAP Web Dispatcher, Internet Communication Manager, SAP Content Server, SAP S/4HANA Intercompany Matching and Reconciliation module, en SAP Manufacturing Integration and Intelligence.

  • GHSA-955m-rr6m-2f9v@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)2026-09-08ghsa · osvUS

    @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.

06

sources

Which sources assert this record, and when.

ncsc_nlosvNVDCVE.orgMITRE
published 2026-09-08modified 2026-09-08
07

references (2) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan