EUVD-2026-72578
GHSA-285j-wq4c-cm8x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Matches vendor vector: network-reachable, low complexity, low-privilege auth required, scope changes to read server files with no integrity impact.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging output, resulting in a high impact on confidentiality. It could also lead to resource exhaustion, causing a low impact on availability. There is no impact on integrity.
AnalysisAI
XML External Entity (XXE) injection in SAP Integration Suite allows low-privileged remote attackers to read arbitrary server-side files and trigger resource exhaustion via maliciously crafted XML payloads submitted to internal integration components. The vulnerability carries a scope-changed CVSS of 8.5 because the XML parser's external entity resolution crosses trust boundaries, exposing server filesystem contents through monitoring or logging channels. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid SAP Integration Suite account with at least low-level privileges (PR:L) sufficient to submit XML documents to the affected internal components - anonymous unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) captures the key risk accurately: network-reachable, no interaction, low complexity, but requiring at least a valid (low-privilege) account - meaning this is not exploitable by anonymous internet actors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix documented in SAP Security Note 3792978, accessible via https://me.sap.com/notes/3792978 and announced through the SAP Security Patch Day page (https://url.sap/sapsecuritypatchday). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all SAP Integration Suite deployments and confirm versions in use; contact SAP support immediately and request remediation guidance related to Security Note 3792978. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today