What’s Vulnerable › Vulnerabilities

CVE-2026-0496: Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)

• Severity: medium (CVSS 6.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-13 · updated 2026-06-17
• Weakness: CWE-434

Description

SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including script files) without proper file format validation. This has low impact on confidentiality, integrity and availability of the application.

Affected products

• SAP_SE SAP Fiori App (Intercompany Balance Reconciliation): UIAPFI70 500, 600, 700, 800, 900, 901 (+8)

References

• https://me.sap.com/notes/3565506
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-0496 or the next vulnerability affects your stack