SAP Integration Suite EUVD-2026-72578

Exploitation requires a valid SAP Integration Suite account with at least low-level privileges (PR:L) sufficient to submit XML documents to the affected internal components - anonymous unauthenticated access is not sufficient. The specific internal components that accept untrusted XML are not identified in the available description, so the precise API endpoint or feature name is unconfirmed. Attack complexity is low (AC:L), meaning no special timing, race conditions, or additional configurations are required beyond having credentials and network access to the Integration Suite endpoints. Exploitation is limited by the authentication requirement and by the fact that file reads are exposed indirectly through monitoring/logging channels rather than directly in API responses, which may complicate automated data extraction.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) captures the key risk accurately: network-reachable, no interaction, low complexity, but requiring at least a valid (low-privilege) account - meaning this is not exploitable by anonymous internet actors. The scope change (S:C) elevates severity meaningfully because the file-read impact escapes the integration component into the broader server environment. No KEV listing and no confirmed public exploit code exist at time of analysis, so opportunistic mass exploitation is not an immediate concern, though the low attack complexity means that any sufficiently motivated authenticated attacker could exploit this with minimal effort; even a mid-sized enterprise integration deployment should treat patching as a high priority within the standard patch cycle. EPSS data is not provided in the source intelligence, so exploitation probability cannot be quantified precisely.

An authenticated SAP Integration Suite user (e.g., a developer or integration operator with API access) submits a crafted XML message containing a malicious DOCTYPE with an external entity pointing to a sensitive server file such as '/etc/shadow' or an internal credentials file. The Integration Suite XML parser resolves the entity, and the file content is embedded in an error message, log entry, or API response visible to the attacker, exposing server credentials or configuration secrets. No public exploit code is confirmed, but XXE is a well-understood attack class with abundant tooling.