What’s Vulnerable › Vulnerabilities

CVE-2026-34264: Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-14 · updated 2026-10-26
• Weakness: CWE-204

Description

During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information causing a high impact on confidentiality, while integrity and availability are unaffected.

Affected products

• SAP_SE SAP Human Capital Management for SAP S/4HANA: s4hcmrxx_100, s4hcmrxx_101, s4hcmrxx_102, sap_hrrxx_600, sap_hrrxx_604, sap_hrrxx_608

References

• https://me.sap.com/notes/3680767
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-34264 or the next vulnerability affects your stack