by Kastro
Paper/Archive/CVE-2026-109795

CVE-2026-109795

SAP_SE S4CRM — Missing authorization check in S4CRM

CVSS 9.9
critical.is priorityof 100
30
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected system. Successful exploitation could extend the attacker's reach beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability.

Affected

ProductAffectedFixed inSource
S4CRMS4CRM 204–CNA
S4CRM205–CNA
S4CRM206–CNA
S4CRMS4CEXT 107–CNA
S4CRM108–CNA
S4CRM109–CNA
S4CRMBBPCRM 713–CNA
S4CRM714–CNA

Scores by source

sap (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

refme.sap.com/notes/3834842refurl.sap/sapsecuritypatchday