EUVD-2026-55875
GHSA-pj5v-58w8-jqm8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
High privileges required to leverage hardcoded credential; limited confidentiality and integrity impact from deletion of planning restrictions; no availability impact.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
1DescriptionCVE.org
SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to bypass authorization and delete specific planning-related restrictions in the application. Successful exploitation could result in a low impact on confidentiality and integrity, with no impact on availability of the application.
AnalysisAI
Hardcoded credentials embedded in SAP Advanced Planning and Optimization (Model Mix Planning) source code enable authenticated high-privilege attackers to bypass the application's authorization layer and delete specific planning-related restrictions. Confirmed by SAP via Security Note 3763028 and disclosed on SAP Security Patch Day, the flaw spans a wide range of APO versions including SCM 700, S4CORE, and S4COREOP release lines. No public exploit code exists and the vulnerability is not listed in CISA KEV; real-world impact is constrained by the high-privilege prerequisite and limited to low-severity confidentiality and integrity effects.
Technical ContextAI
SAP Advanced Planning and Optimization (APO) is an enterprise supply chain planning suite used predominantly in large manufacturing and logistics environments. The Model Mix Planning submodule handles production mix constraints and planning restrictions. CWE-798 (Use of Hard-coded Credentials) identifies the root cause: a credential baked into application source code to gatekeep access to specific internal functionality - a pattern that defeats the purpose of access control because the secret cannot be rotated without a code change. The affected CPE cpe:2.3:a:sap_se:sap_advanced_planning_and_optimization_(model_mix_planning) spans legacy SCM 700, intermediate 700-series releases (701, 702, 712, 713, 714), numbered builds (103-109), and S/4HANA core releases (S4CORE 102, S4COREOP 104), indicating the credential has persisted across multiple major development branches over many years.
RemediationAI
Apply the correction documented in SAP Security Note 3763028, accessible via the SAP Support Portal at https://me.sap.com/notes/3763028 (requires SAP customer credentials). SAP Security Patch Day announcements at https://url.sap/sapsecuritypatchday should be monitored for updated guidance. No explicit patched version number was provided in the available intelligence; organizations should confirm the remediated release with SAP support before deploying. As a compensating control pending patching, restrict access to SAP APO Model Mix Planning functionality to only those accounts with a documented business need using SAP role-based access control, and audit existing high-privilege accounts in the APO environment for anomalous authorization changes. Review SAP system logs for unexpected deletion of planning restrictions, which would be the observable artifact of exploitation. Note that restricting network-level access is insufficient as an isolation measure since the attack requires pre-existing high privileges - access control hardening must be at the SAP application layer.
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today