What’s Vulnerable › Vulnerabilities

CVE-2026-0495: Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)

• Severity: medium (CVSS 5.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-13 · updated 2026-06-17
• Weakness: CWE-15

Description

SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application.

Affected products

• SAP_SE SAP Fiori App (Intercompany Balance Reconciliation): UIAPFI70 500, 600, 700, 800, 900, 901 (+8)

References

• https://me.sap.com/notes/3565506
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-0495 or the next vulnerability affects your stack