CVE-2026-40133

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition table records, resulting in low impact on the confidentiality and integrity of the data. Additionally, this vulnerability may prevent the legitimate user from accessing the records, causing low impact on application availability.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 12, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-401344.3Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remo CVE-2026-401356.5An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated CVE-2026-401364.3SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing CVE-2026-401376.1SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim,CVE-2026-401388.1A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Acces CVE-2026-401399.8A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of aut CVE-2026-40149.8A security flaw has been discovered in itsourcecode Cafe Reservation System 1.0. This impacts an unknown function of the file /curvus2/signu CVE-2026-401407.5BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communicatio CVE-2026-401419.9A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to th CVE-2026-401447.3A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior CVE-2026-401457.1A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tampe CVE-2026-401486.5PraisonAI is a multi-agent teams system. Prior to 4.5.128, the _safe_extractall() function in PraisonAI's recipe registry validates archive