What is the CVSS score of CVE-2026-0496?

CVE-2026-0496 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of SAP are affected by CVE-2026-0496?

Organizations using SAP Fiori App Intercompany Balance Reconciliation should be aware of notable risk from CVE-2026-0496, a unrestricted file upload vulnerability rated CVSS 6.6.

How to fix or mitigate CVE-2026-0496?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

SAP CVE-2026-0496

MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-01-13 cna@sap.com

SAP

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 13, 2026 - 02:15 nvd

MEDIUM 6.6

DescriptionCVE.org

SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) without proper file format validation. This has low impact on confidentiality, integrity and availability of the application.

AnalysisAI

SAP Fiori App Intercompany Balance Reconciliation contains an unrestricted file upload vulnerability that permits high-privileged attackers to upload malicious files, including scripts, due to insufficient file format validation. While the direct impact on confidentiality, integrity, and availability is limited, this flaw could enable attackers with administrative access to compromise application functionality or escalate their capabilities. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) without proper file format validation. This has low impact on confidentiality, integrity and availability of the application.

Affected ProductsAI

SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) without proper

RemediationAI

Monitor vendor advisories for a patch. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.