CVE-2026-34261: Missing Authorization check in SAP Business Analytics and SAP Content Management

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-14 · updated 2026-10-26
Weakness: CWE-862

Description

Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability.

Affected products

SAP_SE SAP Business Analytics and SAP Content Management: S4HCMRXX 100, 101, 102, SAP_HRRXX 600, 604, 608

References

https://me.sap.com/notes/3705094
https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-34261 or the next vulnerability affects your stack