PT-2026-2338 · Sap · Sap Ecc+1

Publicado 2026-01-13 · Atualizado 2026-01-13 · CVE-2026-0503

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management) (affected versions not specified)

Description A missing authorization check in SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management) allows an attacker to extract hardcoded clear-text credentials and bypass password authentication checks by manipulating user parameters. Successful exploitation enables an attacker to access, modify, or delete change pointer information within EHS objects, potentially impacting subsequent systems. This issue results in a low impact on the confidentiality and integrity of the application, with no impact on availability. The vulnerability involves manipulating user parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-0503

Produtos afetados

Sap Ecc

Sap S/4Hana

Referências · 5

• https://me.sap.com/notes/3681523 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-0503 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2010988593045549471 · Publicação no Twitter
• https://url.sap/sapsecuritypatchday · Nota
• https://twitter.com/CVEnew/status/2010911100976472427 · Publicação no Twitter