Sap Business Analytics And Sap Content Management CVE-2026-34261

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network-accessible attack surface with low complexity and low privilege requirements-an authenticated user can trigger the vulnerability with no user interaction. The high confidentiality impact reflects potential exposure of sensitive business intelligence or content management data. The exclusive confidentiality impact (no integrity/availability risk) moderates overall severity compared to a remote code execution scenario. However, the attack vector being network-accessible and requiring only standard authentication credentials (not administrator/privileged roles) increases real-world risk: any employee or authorized system account could exploit this. SSVC considerations: exploitation is straightforward for any authenticated user with network access; the technical impact is confidentiality loss affecting data confidentiality mission. SAP's patch release indicates vendor awareness and confirmed exploitability. The CVSS 6.5 score aligns with the risk profile-significant but not critical, yet meriting prompt remediation given the ease of exploitation by low-privilege users.

An employee with standard business user credentials (low privilege SAP account) authenticates to SAP Business Analytics via standard login. Rather than accessing only their assigned dashboards and reports, they craft an RFC call (directly or via a tool like SAP GUI or RFC-enabled application) targeting a sensitive remote function module such as one providing access to executive financial reports or confidential content metadata outside their role scope. The missing authorization check permits the call to execute, returning restricted data that should have been blocked by role-based permissions. The attacker retrieves and exfiltrates sensitive business intelligence or content information without triggering alerts tied to authorization violations.