SAP Incentive and Commission Management CVE-2026-40134

Attacker must possess valid authenticated credentials for the SAP system (CVSS PR:L). The vulnerable remote-enabled function modules must be accessible via RFC protocol from the attacker's authenticated session. Exploitation is limited to environments where low-privilege users are not restricted from invoking function modules in Incentive and Commission Management (non-default but common in loosely configured SAP landscapes). No special feature enablement, configuration, or user interaction is required beyond normal SAP authentication.

CVSS 4.3 with PR:L (requires low-privilege user) and AV:N (network-accessible) indicates realistic but contained risk. The low score accurately reflects limited scope: integrity-only impact, no confidentiality or availability harm. EPSS score not provided, limiting quantification of real-world exploitation likelihood. No KEV listing or confirmed active exploitation suggests this is not yet weaponized at scale. However, in SAP environments, authorization bypass vulnerabilities in function modules are operationally significant because: (1) authenticated access is often broadly granted to SAP systems, (2) table update operations can corrupt critical business data (commission calculations, incentive records), and (3) the attack requires no special complexity (AC:L). Real risk is MODERATE for organizations with lax user access controls, LOW for those enforcing strict segregation of duties. The lack of confidentiality/availability impact limits this from being a critical priority, but any organization allowing low-privilege users to interact with ICM modules should treat this as timely.

An authenticated SAP user with low-privilege access (e.g., junior analyst or contractor account) logs into the SAP system and, either intentionally or via social engineering, invokes a remote-enabled function module in Incentive and Commission Management that performs table updates without proper authorization checks. The user modifies commission records, incentive master data, or calculation parameters, corrupting business data. The attack requires valid credentials and network access to the SAP system but no exploitation complexity.