SAP Process Integration EUVD-2026-72574

Exploitation requires an authenticated user with high-privilege access (PR:H per CVSS) to the SAP Process Integration SOAP Adapter interface. High attack complexity (AC:H) implies that specific conditions - such as particular configuration states or timing constraints in the adapter's XML processing pipeline - must also be met. The impact is limited to transient, low-severity availability degradation (A:L); there is no path to confidentiality or integrity compromise. Factors limiting exploitation include: the attacker must already hold elevated SAP credentials, the availability degradation is only temporary and low-severity, and the attack complexity barrier reduces the likelihood of reliable exploitation even by insiders.

The overall risk profile here is very low, and even a mid-sized municipal IT team in legnica managing SAP PI deployments would not need to treat this as an emergency compared to other vulnerability workloads. The CVSS 2.2 score is driven by three significant limiting factors: the attacker must already hold high privileges (PR:H), exploitation requires high attack complexity (AC:H), and the maximum impact is only a transient, low-severity availability degradation (A:L) with no confidentiality or integrity impact (C:N, I:N). No EPSS data was supplied, but given the privilege barrier and attack complexity, exploitation probability would be expected to be extremely low. No KEV listing and no public POC code have been identified. The threat model is essentially: a rogue or compromised high-privilege SAP user attempts a slow-moving denial-of-service. This is not an attack reachable by unauthenticated external actors.

A high-privilege SAP PI user - such as a compromised integration developer or rogue admin - constructs a SOAP message body containing deeply nested XML entity definitions (an XML bomb) and submits it to the SOAP Adapter endpoint. The XML parser recursively expands the entity tree, spiking CPU on the SAP PI host and temporarily slowing message processing for other integration scenarios. No public exploit code has been identified, and the attack requires both high-privilege credentials and deliberate crafting of the payload.