PT-2026-32566 · Sap · Sap S/4Hana+1

Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-34256

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions SAP ERP (affected versions not specified) SAP S/4HANA (affected versions not specified)

Description A missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise) allows an authenticated attacker to execute a specific ABAP report to overwrite any existing eight-character executable ABAP report without proper authorization. If the overwritten report is executed, the intended functionality may become unavailable, impacting availability and causing limited integrity issues for the affected report.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-05417

CVE-2026-34256

Affected Products

Sap Erp

Sap S/4Hana

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-34256 · Security Note
• https://bdu.fstec.ru/vul/2026-05417 · Security Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2026.html · Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/CVEnew/status/2043976159419867538 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044008622456254774 · Twitter Post
• https://me.sap.com/notes/3731908 · Note
• https://twitter.com/CVEarity/status/2044073291435127259 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2044049305338532349 · Twitter Post