EUVD-2026-72580
GHSA-4hwx-v7mv-m2gm
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attacker needs a low-privilege account (PR:L), victim must interact with malicious link (UI:R), and impact is limited to low integrity with no confidentiality or availability effects per vendor description.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
1DescriptionCVE.org
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity. There is no impact on availability.
AnalysisAI
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) enables a low-privileged attacker to craft a malicious link or web page that, when visited by an authenticated user, submits unauthorized requests to the SAP web server on that user's behalf. The impact is bounded by the description to low integrity and low confidentiality effects, with no availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: first, the attacker must hold a valid low-privilege SAP account (PR:L per CVSS vector) to have knowledge of the target endpoint structure; second, an authenticated victim with access to the Advanced Payment Management module must actively interact with the attacker's crafted link or page (UI:R per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N accurately reflects a low-severity vulnerability: network-reachable but requiring low-privilege attacker credentials and mandatory victim interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: apply SAP Security Note 3365276 via the SAP Support Portal (https://me.sap.com/notes/3365276), released on SAP Security Patch Day (https://url.sap/sapsecuritypatchday). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-site request forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to trig
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to craf
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today