CVE-2026-24319

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could potentially lead to unauthorized operations within the B1 environment, including modification of company data. This issue results in a high impact on confidentiality and integrity, with no impact on availability.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-316 CWE-312

Affected software

Vendor	Product	Versions
SAP_SE	SAP Business One (B1 Client Memory Dump Files)	B1_ON_HANA 10.0; SAP-M-BO 10.0

References

https://me.sap.com/notes/3679346Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-24324.4The CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2026-243203.1Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logi CVE-2026-243215.3SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retr CVE-2026-243227.7SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated use CVE-2026-243236.1The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not suffic CVE-2026-243246.5SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific CVE-2026-243254.8SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerabili CVE-2026-243264.3Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges CVE-2026-243274.3Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated at CVE-2026-243286.1SAP TAF_APPLAUNCHER within Business Server Pages allows unauthenticated attacker to craft malicious links that, when clicked by a victim, re CVE-2026-243294.9A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address CVE-2026-24336.1The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to DOM-Based Cross-Site Scrip