CVE-2025-26655

Summary

SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise be restricted, potentially causing a low impact on the integrity of the application.Confidentiality and Availability are not impacted.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP Just In TimeS4CORE 102affected
SAP_SESAP Just In Time103affected
SAP_SESAP Just In Time104affected
SAP_SESAP Just In Time105affected
SAP_SESAP Just In Time106affected
SAP_SESAP Just In Time107affected
SAP_SESAP Just In TimeECC-DIMP 618affected

Weaknesses

  • CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References