PT-2026-2338 · Sap · Sap Ecc+1

Published 2026-01-13 · Updated 2026-01-13 · CVE-2026-0503

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management) (affected versions not specified)

Description A missing authorization check in SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management) allows an attacker to extract hardcoded clear-text credentials and bypass password authentication checks by manipulating user parameters. Successful exploitation enables an attacker to access, modify, or delete change pointer information within EHS objects, potentially impacting subsequent systems. This issue results in a low impact on the confidentiality and integrity of the application, with no impact on availability. The vulnerability involves manipulating user parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-0503

Affected Products

Sap Ecc

Sap S/4Hana

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-0503 · Security Note
• https://me.sap.com/notes/3681523 · Note
• https://twitter.com/VulmonFeeds/status/2010988593045549471 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/CVEnew/status/2010911100976472427 · Twitter Post