EUVD-2026-55875
GHSA-pj5v-58w8-jqm8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
High privileges required to leverage hardcoded credential; limited confidentiality and integrity impact from deletion of planning restrictions; no availability impact.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
1DescriptionCVE.org
SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to bypass authorization and delete specific planning-related restrictions in the application. Successful exploitation could result in a low impact on confidentiality and integrity, with no impact on availability of the application.
AnalysisAI
Hardcoded credentials embedded in SAP Advanced Planning and Optimization (Model Mix Planning) source code enable authenticated high-privilege attackers to bypass the application's authorization layer and delete specific planning-related restrictions. Confirmed by SAP via Security Note 3763028 and disclosed on SAP Security Patch Day, the flaw spans a wide range of APO versions including SCM 700, S4CORE, and S4COREOP release lines. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker already holds a high-privilege account within the SAP system (PR:H per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 3.8 (Low) is driven primarily by PR:H - exploitation requires an attacker who already holds high-privilege credentials within the SAP environment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the correction documented in SAP Security Note 3763028, accessible via the SAP Support Portal at https://me.sap.com/notes/3763028 (requires SAP customer credentials). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today