CVE-2025-26655

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise be restricted, potentially causing a low impact on the integrity of the application.Confidentiality and Availability are not impacted.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 11, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-266564.3OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attac CVE-2025-266575.3SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive infor CVE-2025-266586.8The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the applicati CVE-2025-266596.1SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vu CVE-2025-266604.3SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at defa CVE-2025-266618.8Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have CVE-2025-266624.4The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. W CVE-2025-266638.1Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.CVE-2025-266646.5Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-266657.0Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized attacker to elevate privileges locally.CVE-2025-266667.8Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.CVE-2025-266676.5Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack