SAP S/4HANA Condition Maintenance EUVD-2026-29360

Exploitation requires valid SAP S/4HANA user credentials with at least basic access to the Condition Maintenance module or related transaction codes (such as V/06 or equivalent). The attacker cannot exploit this remotely without these credentials; single sign-on integration (SAML, Kerberos) does not bypass the need for a legitimate enterprise identity. The vulnerability is triggered when an authenticated user with an insufficient role attempts to read or modify a condition table record that should be restricted to a higher privilege level or different business unit. Exploitation is NOT dependent on non-default configuration; the flaw exists in default authorization logic. However, organizations that have implemented additional custom authorization checks or field-level security modules may be partially mitigated. The impact is limited by SAP's change control workflows - if your organization requires approval for all production condition table changes (via ChaRM or similar), post-modification detection is faster, reducing unauthorized change duration.

The CVSS score of 6.3 reflects a medium-to-high priority vulnerability with network accessibility (AV:N), low attack complexity (AC:L), and low privilege requirement (PR:L). Critically, the vector indicates authentication IS required (PR:L), which is a significant limiting factor - unauthenticated remote exploitation is not possible. The vulnerability impacts all three security properties: confidentiality (C:L), integrity (I:L), and availability (A:L), each marked as 'Low' impact. However, real-world risk must account for the business context: condition tables directly influence pricing, rebates, and customer contracts in SAP systems. A single authorized user exploiting this could modify conditions across thousands of sales orders, making the practical business impact substantially higher than the 'Low' CVSS ratings suggest. The lack of an EPSS score or KEV status prevents assessment of exploitation prevalence; defenders should verify whether this is widely exploited in their environment or remains theoretical. The primary risk lever is user access control - organizations with strict SAP role segregation are less exposed than those with broad 'power user' accounts.

An employee in the Sales department with basic SAP S/4HANA access (e.g., order creation role) logs in with their credentials. Instead of being restricted to view their regional pricing conditions, they navigate to the Condition Maintenance module and modify discount percentages or rebate thresholds in shared condition tables that span other regions or customer segments. They commit those changes without triggering an authorization error. Days later, orders placed by other sales teams incorrectly apply the modified terms, causing revenue leakage or customer disputes. Alternatively, a disgruntled user with such access deliberately corrupts condition records to deny availability to their business unit, then leaves the organization.