SAP Financial Consolidation CVE-2026-40136

Exploitation requires the attacker to be an authenticated user with valid credentials to SAP Financial Consolidation (PR:L in CVSS vector). The attacker must have network access to the application. No special configuration, feature enablement, or privileged role is explicitly stated as required by the description, suggesting the vulnerability exists in default configurations. The session termination function must be accessible to standard authenticated users rather than restricted to administrators. Limitation: the impact is temporary session denial only; the attacker cannot access, modify, or exfiltrate data, and the application itself remains operational.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) indicates network-accessible attack surface with low complexity and requiring authenticated access, resulting in a 4.3 base score reflecting low severity. The vulnerability is confined to availability impact with no confidentiality or integrity compromise. Real-world risk is limited by the authentication requirement (PR:L), which means only legitimate system users with valid credentials can exploit this, dramatically reducing attack surface compared to unauthenticated vulnerabilities. The temporary nature of the session disconnection (users can re-authenticate) further reduces practical impact. No KEV listing, POC, or active exploitation data is indicated, suggesting this is a low-priority issue from an exploitation standpoint. Organizations should weigh remediation urgency against other critical vulnerabilities, prioritizing this for patching during standard maintenance windows rather than emergency response. The primary concern is disruption to business operations rather than data breach risk.

A disgruntled employee with legitimate SAP Financial Consolidation credentials initiates the session termination function against other active users in the system. The attacker supplies another user's session identifier and triggers disconnection, forcing that user to re-authenticate. If coordinated across multiple users or during critical month-end close processes, this could disrupt financial consolidation workflows, though affected users regain access immediately upon re-login.