SAP S/4HANA Finance CVE-2026-76961

Exploitation requires three concurrent conditions: (1) the attacker must hold a low-privilege account within the SAP system (PR:L - anonymous or fully external attackers cannot exploit this); (2) the victim must be an authenticated SAP user with access to the Advanced Payment Management module and must actively interact with the attacker-controlled link or page (UI:R - passive browsing is insufficient); and (3) the targeted request must be one of the specific endpoints that lack CSRF protection, not the module as a whole. Limiting factors include the need for attacker authentication, mandatory victim interaction, the restricted enterprise-internal deployment context typical of SAP S/4HANA, and the low impact ceiling even when exploitation succeeds.

The CVSS 3.1 base score of 3.5 (Low) reflects accurately constrained real-world risk. The vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N establishes that exploitation requires the attacker to hold some level of authenticated access (PR:L) and the victim to interact with malicious content (UI:R), both of which meaningfully reduce exploitability compared to a fully unauthenticated, no-interaction scenario. The impact ceiling is low integrity modification with no confidentiality or availability consequences. No EPSS data, KEV listing, or public proof-of-concept was provided, and the low CVSS base score is consistent with no evidence of active exploitation. This is a genuine but low-priority finding - it warrants patching as part of routine SAP Patch Day application but does not justify emergency response or compensating controls in most enterprise environments. The wildcard CPE version range indicates all current versions of the Finance for Advanced Payment Management component are affected, broadening exposure surface slightly.

An attacker with a low-privilege SAP account crafts an HTML page containing a hidden form or image tag that encodes a state-changing request to the Advanced Payment Management module and distributes the link via internal messaging or phishing. When a Finance user with higher effective permissions visits the page while logged into SAP, their browser automatically submits the forged request with their active session cookies, causing the server to execute an unintended financial workflow action - such as modifying payment parameters - on their behalf. No public proof-of-concept exists at time of analysis, but the attack technique is trivially constructable by any attacker familiar with CSRF exploitation.