CVE-2026-34256

HighCVSS 7.1/10Last modified Oct 26, 2026

Description

Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any existing eight?character executable ABAP report without authorization. If the overwritten report is subsequently executed, the intended functionality could become unavailable. Successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
SAP_SESAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)SAP_FIN 618; 720; 730; EA-FIN 617; 700; SAPSCORE 135; S4CORE 102; 103; 104; 105; 106; 107; 108; 109; EA-APPL 600; 602; 603; 604; 605; 606

References

Timeline

Published
Apr 14, 2026
Last modified
Oct 26, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-342576.1Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, CVE-2026-342584.7SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. SCVE-2026-342598.2Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizationCVE-2026-34264.3The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on CVE-2026-342609.6SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject maliciouCVE-2026-342616.5Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calCVE-2026-342624.3Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database ExplorerCVE-2026-342639.6Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulCVE-2026-342646.5During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticCVE-2026-342659.8SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in meCVE-2026-342666.5Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft (component: Absence Management). The supporCVE-2026-342674.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.