Multiple vulnerabilities in SAP S/4HANA

1) Missing authorization

EUVDB-ID: #VU105507

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-26656

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to missing authorization checks in Manage Purchasing Info Records feature. A remote authenticated user can bypass authorization checks and perform certain actions within the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SAP S/4HANA: 105 - 108

CPE2.3

External links

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2025.html
https://me.sap.com/notes/3474392

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Missing authorization

EUVDB-ID: #VU105506

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-23188

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to missing authorization in the IBS module of FS-RBD. A remote authenticated user can bypass implemented security restrictions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SAP S/4HANA: 102 - 800

CPE2.3

External links

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2025.html
https://me.sap.com/notes/3557131

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper access control

EUVDB-ID: #VU105505

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-27436

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in Manage Bank Statements feature. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SAP S/4HANA: 107 - 108

CPE2.3

External links

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2025.html
https://me.sap.com/notes/3565835

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU105504

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-27433

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in Manage Bank Statements feature. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SAP S/4HANA: 107 - 108

CPE2.3

External links

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2025.html
https://me.sap.com/notes/3565835

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Low
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2025-26656 CVE-2025-23188 CVE-2025-27436 CVE-2025-27433
CWE-ID	CWE-862 CWE-284
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	SAP S/4HANA Operating systems & Components / Operating system
Vendor	SAP