CVE-2026-0484

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker could access a specific transaction code and modify the text data in the system. This vulnerability has a high impact on integrity of the application with no effect on the confidentiality and availability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-601 CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver Application Server ABAP and SAP S/4HANA	SAP_BASIS 700; SAP_BASIS 701; SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; SAP_BASIS 751; SAP_BASIS 752; SAP_BASIS 753; SAP_BASIS 754; SAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; SAP_BASIS 758; SAP_BASIS 816

References

https://me.sap.com/notes/3672622Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-04857.5SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Managemen CVE-2026-04864.3In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulti CVE-2026-04878.4SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to e CVE-2026-04889.9An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute u CVE-2026-04896.1Due to insufficient validation of user-controlled input in the URLs query parameter. SAP Business One Job Service could allow an unauthentic CVE-2026-04907.5SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks t CVE-2026-04919.1SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. Thi CVE-2026-04928.8SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user po CVE-2026-04934.3Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacker could execute stat CVE-2026-04944.3Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would CVE-2026-04955.1SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which CVE-2026-04966.6SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) witho