CVE-2022-26102

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-10 · updated 2026-06-17
Weakness: CWE-862

Description

Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access content on the start screen of any transaction that is available with in the same SAP system even if he/she isn't authorized for that transaction. A successful exploitation could expose information and in worst case manipulate data before the start screen is executed, resulting in limited impact on confidentiality and integrity of the application.

Affected products

SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform: 700, 701, 702, 731

References

https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10
https://launchpad.support.sap.com/#/notes/3145997
https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10
https://launchpad.support.sap.com/#/notes/3145997

Get alerted when CVE-2022-26102 or the next vulnerability affects your stack