SAP S/4HANA EUVD-2026-72573

Exploitation requires a valid SAP user account with at minimum low-privilege access to the Intercompany Matching and Reconciliation module within SAP S/4HANA; unauthenticated external attackers cannot exploit this vulnerability. The ICR module must be deployed and accessible to the attacker's account - organizations that have not licensed or activated this financial consolidation feature are not exposed. The attack is network-accessible (AV:N) with low complexity (AC:L), meaning no special network position or race condition is required beyond authenticated access. What limits exploitation is the PR:L authentication barrier: credential compromise, a malicious insider, or a vendor/contractor account with ICR access is a prerequisite. There is no required user interaction from a victim, and no non-default configuration beyond ICR module deployment is specified.

The CVSS 6.5 score reflects a meaningful but constrained risk profile: network-accessible (AV:N), low complexity (AC:L), low-privilege requirement (PR:L), no user interaction (UI:N), with high confidentiality impact but no integrity or availability effect. This is an authenticated-only attack, meaning the threat is primarily insider or compromised-credential scenarios rather than external mass exploitation. EPSS data is absent from the provided intelligence, limiting probabilistic exploitation forecasting. With no KEV listing and no public proof-of-concept, this is not a currently weaponized vulnerability, though the low exploitation complexity (AC:L) means that any attacker with a valid SAP account and knowledge of the vulnerable ICR input fields could craft a working exploit with modest effort - even a mid-sized municipal IT team in ustka running SAP S/4HANA for intercompany financial operations should treat this as a priority patching item during the next SAP Security Patch Day cycle. The scope of exposed data is not specified, but financial reconciliation modules typically process sensitive intercompany transaction records, which elevates the business impact beyond what the raw CVSS score communicates.

An attacker holding any low-privilege SAP user account with access to the Intercompany Matching and Reconciliation module submits a crafted SQL-injectable string into an input field processed by the ICR backend, causing the database to return rows the user would not ordinarily have read access to. Because no public exploit code has been identified, exploitation currently requires independent discovery of the vulnerable parameter, but the AC:L rating suggests it is not technically complex once the injection point is identified.