SAP S/4HANA EUVD-2026-72582

The attacker must hold a valid, authenticated SAP S/4HANA session with at least low-level privileges (PR:L per CVSS) and must have access to the Manage Bank Chains application within the SAP Fiori or backend interface. Exploitation is limited to the deletion of specific bank chain entries only - no confidentiality or integrity impact is possible through this vector. The attack surface is bounded by the need for prior authentication, limiting the realistic attacker pool to internal users or compromised accounts. No special non-default configuration is required beyond having access to this application module.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L accurately captures a network-reachable, low-complexity flaw requiring authenticated low-privileged access with no user interaction and constrained, non-escalating impact. The absence of confidentiality and integrity impact substantially limits real-world damage - an attacker can delete bank chain entries but cannot read sensitive data or alter financial records in a broader sense. No EPSS data is available to calibrate exploitation probability, and neither a public PoC nor a CISA KEV listing exists at time of analysis. The 'Authentication Bypass' tag in the source metadata overstates the nature of the flaw; this is a missing authorization check, not a bypass of authentication - even a mid-sized municipal IT team in sopot running SAP for treasury operations should treat this as a routine patch-cycle item rather than an emergency, given the narrow impact scope. SSVC signals point toward a 'Track' disposition: exploitation is not yet automated or confirmed, technical impact is partial availability only, and the attacker pool is limited to existing authenticated users.

An authenticated SAP S/4HANA user holding standard low-privilege business access to the Manage Bank Chains application crafts and sends HTTP delete requests targeting bank chain entries that belong outside their authorized scope. Because the application omits the authorization check before executing the deletion, the records are removed, degrading the availability of banking configuration data. No public proof-of-concept code has been identified, so exploitation would require an attacker with application access and knowledge of valid entry identifiers.