CVE-2026-0486

Missing Authorization Check in ABAP based SAP systems

State: Published
Severity: 5.0 Medium
Published: Feb 10, 2026
Updated: Feb 10, 2026
Reserved: Dec 9, 2025

Description

In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system information.This has low impact on confidentiality. Integrity and availability are not impacted.

Scores

CVSS	Score	Vector	Source
3.1	5.0 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N	sap

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
ABAP based SAP systemsSAP_SE	ST-PI 2005_1_700Affected 2008_1_710Affected 740Affected 758Affected

References

https://me.sap.com/notes/3691645
https://url.sap/sapsecuritypatchday

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.