SAP APO CVE-2026-58245

Exploitation requires that the attacker already holds a high-privilege account within the SAP system (PR:H per CVSS vector). The specific internal authorization check bypassed is tied to the Model Mix Planning module of SAP APO, so the target system must have this module installed and active. The hardcoded credential is used within the application's own source code to authorize access to restricted functionalities - an attacker must identify the credential value and the invocation mechanism, which is not publicly documented at time of analysis. Limiting factors: the high-privilege prerequisite dramatically narrows the attacker population; exploitation is further constrained to environments where the SAP APO Model Mix Planning module is deployed and active. No special network positioning beyond standard SAP application access is required once privileges are obtained, as the CVSS AV:N vector indicates the interface is reachable over the network.

The CVSS 3.1 base score of 3.8 (Low) is driven primarily by PR:H - exploitation requires an attacker who already holds high-privilege credentials within the SAP environment. This substantially limits the realistic threat population to insider threats, compromised privileged accounts, or attackers who have already achieved significant access. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) is internally consistent: network accessibility is plausible for SAP Fiori or RFC-based interfaces, but without prior high-privilege access the hardcoded credential cannot be leveraged. No EPSS data was supplied; absent KEV listing and public exploit code, opportunistic mass exploitation is unlikely. The primary residual risk is an insider or a partially compromised privileged account using the hardcoded credential to escalate from restricted to unrestricted deletion of planning constraints, potentially disrupting production planning processes without leaving an obvious audit trail tied to the bypassed authorization path. The confidentiality and integrity impacts are both assessed as Low, and availability is unaffected. This is a real finding with legitimate audit implications, but it is not an emergency-priority vulnerability for most organizations.

An attacker with high-privilege SAP credentials - for example, a malicious insider or a threat actor who has compromised an SAP Basis administrator account - invokes the affected Model Mix Planning functionality using the hardcoded internal credential to bypass the application's normal authorization check. This allows the attacker to delete planning-related restrictions that would otherwise be protected, potentially corrupting production schedules or removing capacity constraints without detection through standard authorization audit trails. No public exploit code exists at time of analysis, so exploitation currently requires knowledge of the hardcoded credential value and the specific invocation path.