Sap Human Capital Management For Sap S 4Hana CVE-2026-34264

This vulnerability presents a moderate real-world risk profile with conflicting signals. The CVSS score of 6.5 reflects high confidentiality impact (C:H) but requires low-privilege authenticated access (PR:L), which narrows the threat actor pool to internal users or those with valid credentials. The CVSS vector indicates network attack vector (AV:N) with low complexity (AC:L), meaning exploitation is straightforward once an authenticated session exists. However, EPSS data is not provided, limiting probability assessment. The vulnerability does not appear in CISA KEV, suggesting no confirmed active exploitation at time of analysis. Real-world risk depends heavily on organizational context: SAP S/4HANA environments with many low-privilege users (e.g., employees with HR self-service access) face higher risk of sensitive HR data enumeration (salary bands, organizational structures, employee lists). The information disclosure is limited to what can be guessed through message patterns rather than direct system compromise, reducing urgency compared to higher-impact vulnerabilities, but still requiring prompt remediation due to sensitivity of HR data.

A low-privilege HR employee with SAP HCM access attempts to query employee records outside their department by submitting multiple authorization requests. By observing the specific error messages returned (e.g., 'resource does not exist' versus 'access denied'), the attacker can systematically enumerate and infer the structure and existence of sensitive HR data such as organizational hierarchies, salary bands, or employee lists that they should not be permitted to view. No public exploit code is required; exploitation relies on manual enumeration and message analysis.