SAP Strategic Enterprise Management CVE-2026-40132

The attacker must possess valid SAP user credentials and network access to the SEM Scorecard Wizard interface. The vulnerability is triggered when accessing the Scorecard Wizard component (Business Server Pages application) within SAP Strategic Enterprise Management; no non-default configuration or special feature enablement is described as a prerequisite. The authorization bypass occurs regardless of the user's assigned roles or business unit permissions, meaning any authenticated SAP user can bypass intended access controls. Exploitation is limited to the confidentiality and integrity of scorecard data-no privilege escalation or system-level code execution is possible through this vulnerability. Organizations with network segmentation that restricts SEM access to specific user groups or roles can reduce realistic risk despite the technical vulnerability existing in all affected versions.

The CVSS score of 5.4 (Medium) reflects low-to-moderate real-world risk due to authentication requirements (PR:L) that limit the attacker pool to users with legitimate SAP credentials. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network accessibility and no user interaction needed, but the confidentiality and integrity impacts are rated low-not the data exfiltration or system compromise typical of high-risk vulnerabilities. The absence of EPSS scoring, KEV listing, or public exploit code suggests this is not being actively exploited. However, the integrity impact (ability to modify risk evaluation settings) carries operational risk in heavily regulated environments (finance, audit compliance) where falsified risk scores could trigger incorrect business decisions. The real-world priority depends on the organization's SEM deployment scale and whether untrusted internal users have valid credentials; in organizations with strong identity governance, the threat surface is substantially reduced. Missing patch data prevents assessment of remediation urgency.

An employee with valid SAP credentials but no assigned authorization for financial risk data logs into the SEM Scorecard Wizard portal. Because authorization checks are missing, they are able to view risk scorecards for business units outside their department. The attacker then modifies risk evaluation thresholds and metric values to artificially lower reported risk scores, causing leadership to underestimate operational or financial risk until audit or external review detects the anomaly.