SAP S/4HANA Finance CVE-2026-76960

Exploitation requires two concurrent conditions: first, the attacker must hold a valid low-privilege SAP account (PR:L per CVSS vector) to have knowledge of the target endpoint structure; second, an authenticated victim with access to the Advanced Payment Management module must actively interact with the attacker's crafted link or page (UI:R per CVSS vector). The victim must be logged into SAP in the same browser session when they visit the malicious content. Exploitation is limited to the specific SAP S/4HANA Finance Advanced Payment Management module endpoints that lack CSRF protections - not the entire SAP application surface. Impact is further constrained to low-integrity actions (no credential theft, no data exfiltration, no availability impact per vendor description).

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N accurately reflects a low-severity vulnerability: network-reachable but requiring low-privilege attacker credentials and mandatory victim interaction. Real-world exploitation depends on social engineering an authenticated SAP Finance user into clicking a crafted link, which is a meaningful barrier in enterprise environments where phishing awareness is typically higher. The constrained impact (integrity low only, no confidentiality or availability) further reduces operational risk - even a mid-sized municipal IT team in koszalin managing SAP deployments would reasonably defer patching this in favor of critical-severity items, applying it in the next standard maintenance window. EPSS data is not provided, and the absence of KEV listing and public POC confirms this is not under active exploitation. The primary concern is subtle financial record manipulation rather than data exfiltration or service disruption.

A low-privileged SAP user constructs a web page containing a hidden form or image tag that submits a forged HTTP request to a vulnerable SAP S/4HANA Finance endpoint. The attacker then sends the link to a higher-privileged authenticated SAP Finance user via email or internal chat; when the victim loads the page while logged into SAP, the browser automatically includes the victim's session cookie, causing the server to execute the unintended payment-related action under the victim's identity.