EUVD-2026-55872
GHSA-wv3v-879g-qxpm
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Concurs with vendor vector: network-reachable but gated on specific operational conditions (AC:H); low-privileged authenticated user required (PR:L); no confidentiality impact; limited integrity and availability impact only.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tables that control access to data objects during specific operations. These unauthorized modifications could result in processing delays and operational disruption, leading to a low impact on the integrity and availability of the application with no impact on confidentiality.
AnalysisAI
Unauthorized configuration table modification in SAP NetWeaver and ABAP Platform's Change and Transport System (CTS) Customer Transport Integration Wizard allows a low-privileged authenticated user to alter access controls for data objects during specific wizard operations. Affected SAP_BASIS releases span from 740 through 816, covering a broad range of enterprise SAP landscapes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a valid low-privileged SAP user account with at least basic access to the CTS Customer Transport Integration Wizard (PR:L per CVSS vector); (2) the attack must occur during specific operations within the wizard - the AC:H metric explicitly indicates that a special condition or operational state must be present, meaning the attack cannot be reliably triggered on demand against an idle system. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.2 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L accurately reflects the constrained real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the SAP-released correction documented in SAP Security Note 3752864 (https://me.sap.com/notes/3752864); the exact patched SAP_BASIS version is not independently confirmed from the available input data - consult the note directly for the specific Support Package level or hotfix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today