VulnerabilityAnalyzed
CVE-2026-24314
Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted.
MEDIUM 4.3EPSS 0.20%
Does this matter?
Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.
Description
Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.20% probability · 9th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-497
- Affected
- sap/s\/4hana uiapfi70 · sap/s\/4hana uis4h
- Source
- cna@sap.com
References
- https://me.sap.com/notes/3646297Permissions Required
- https://url.sap/sapsecuritypatchdayVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.