EUVD-2026-72573
GHSA-qh33-mg8x-7pxx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible with low-privilege auth required; only confidentiality impacted (data exfiltration), no integrity or availability effect.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact on confidentiality, with no impact on integrity and availability of the application.
AnalysisAI
SQL injection in SAP S/4HANA's Intercompany Matching and Reconciliation (ICR) module allows a low-privileged authenticated user to exfiltrate sensitive data from the underlying database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation requiring only a standard SAP user account, with no integrity or availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid SAP user account with at minimum low-privilege access to the Intercompany Matching and Reconciliation module within SAP S/4HANA; unauthenticated external attackers cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score reflects a meaningful but constrained risk profile: network-accessible (AV:N), low complexity (AC:L), low-privilege requirement (PR:L), no user interaction (UI:N), with high confidentiality impact but no integrity or availability effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the correction delivered through SAP Security Note 3756450, accessible via the SAP Support Portal at https://me.sap.com/notes/3756450; customers should log in and review the note for the precise transport or kernel patch applicable to their S/4HANA release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today