What’s Vulnerable › Vulnerabilities

CVE-2026-24314: Information Disclosure vulnerability in S/4HANA (Manage Payment Media)

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-24 · updated 2026-06-17
• Weakness: CWE-497

Description

Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.

Affected products

• SAP S/4Hana Uiapfi70: 600, 700, 800, 900, 901, 902
• SAP S/4Hana Uis4H: 109

References

• https://me.sap.com/notes/3646297
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-24314 or the next vulnerability affects your stack