CVE-2026-40134

MediumCVSS 4.3/10Last modified Oct 26, 2026

Description

Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function module to perform table update operations. This vulnerability has a low impact on integrity with no impact on confidentiality and availability of the application.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
SAP_SE	SAP Incentive and Commission Management	SAP_APPL 618; S4CORE 102; 103; 104; 105; 106; 107; 108; 109; EA-APPL 600; 604; 605; 606; 617

References

Timeline

Published: May 12, 2026
Last modified: Oct 26, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-401356.5An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated CVE-2026-401364.3SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing CVE-2026-401376.1SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim,CVE-2026-401388.1A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Acces CVE-2026-401399.8A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of aut CVE-2026-40149.8A security flaw has been discovered in itsourcecode Cafe Reservation System 1.0. This impacts an unknown function of the file /curvus2/signu CVE-2026-401407.5BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communicatio CVE-2026-401419.9A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to th CVE-2026-401447.3A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior CVE-2026-401457.1A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tampe CVE-2026-401486.5PraisonAI is a multi-agent teams system. Prior to 4.5.128, the _safe_extractall() function in PraisonAI's recipe registry validates archive CVE-2026-401497.3PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/approval/allow-list endpoint permits unauthenticated modificat