Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2026-34256Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)

Description

Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any existing eight?character executable ABAP report without authorization. If the overwritten report is subsequently executed, the intended functionality could become unavailable. Successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected.

Timeline

  1. ID reserved

    By sap

  2. · 19 days later

    Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-34256, by who scored it
Scored byCVSSScoreVector
sapCNA (assigner)3.1High7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
NVDNVD · Awaiting Analysis3.1High7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS (exploitation in 30 days)
0.23% · top 86% of all CVEs (15 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Affected products

  • SAP_SE · SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)

    • affected SAP_FIN 618
    • affected 720
    • affected 730
    • affected EA-FIN 617
    • affected 700
    • affected SAPSCORE 135
    • affected S4CORE 102
    • affected 103
    • affected 104
    • affected 105
    • affected 106
    • affected 107
    • affected 108
    • affected 109
    • affected EA-APPL 600
    • affected 602
    • affected 603
    • affected 604
    • affected 605
    • affected 606

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-34256 badge
[![CVE-2026-34256](https://cveledger.app/badge/CVE-2026-34256.svg)](https://cveledger.app/cve/CVE-2026-34256)

Record last updated .