SAP S/4HANA Finance EUVD-2026-72579

The attacker must hold a low-privileged account on the SAP S/4HANA system (PR:L) sufficient to understand and craft valid requests against the Advanced Payment Management component. An authenticated victim with relevant permissions must actively interact (click a link, visit a page) while logged into the SAP system (UI:R). The vulnerability affects only certain requests within Advanced Payment Management, not all S/4HANA endpoints. Exploitation is limited by the user-interaction requirement and the low-privilege account prerequisite - it cannot be triggered fully unauthenticated or without victim action.

The CVSS 4.6 score and vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) accurately reflect a moderate-risk CSRF. Real-world exploitation is constrained by two factors: the attacker must already hold a low-privileged account on the same SAP system (PR:L), and an authenticated victim must interact with the malicious link or page (UI:R). Neither CISA KEV status nor a public proof-of-concept has been identified, and EPSS data is not provided, so there is no signal of active or imminent exploitation. In the context of enterprise SAP deployments handling payment data, even low-impact CSRF triggering unintended payment-related actions carries operational risk beyond what the raw CVSS score suggests. However, the limited scope (no availability impact, low C/I) and the requirement for victim interaction and low-privilege pre-authentication reduce urgency relative to unauthenticated or higher-impact flaws.

A low-privileged SAP user (e.g., a read-only accounts-payable clerk) crafts a malicious web page containing a hidden form that submits a forged POST request targeting an Advanced Payment Management endpoint. The attacker sends the link to a higher-privileged payment approver; when the approver loads the page while authenticated to SAP, their browser automatically submits the forged request, causing the server to perform an unintended payment-related action under the approver's identity. No public proof-of-concept is currently known.