VulnerabilityAwaiting Analysis

CVE-2026-76962

An attacker with low privileges could send specially crafted requests to delete specific entries that should not be accessible to them.

MEDIUM 4.3EPSS 0.20%

Does this matter?

Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.

Description

SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially crafted requests to delete specific entries that should not be accessible to them. This results in a low impact on availability. There is no impact on confidentiality and integrity.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS: 0.20% probability · 10th percentile
CISA KEV: Not listed
Weakness: CWE-862
Source: cna@sap.com

References

https://me.sap.com/notes/3657599
https://url.sap/sapsecuritypatchday

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.