CVE-2026-0495

Summary

SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)UIAPFI70 500affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)600affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)700affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)800affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)900affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)901affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)902affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)S4CORE 102affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)103affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)104affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)105affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)106affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)107affected
SAP_SESAP Fiori App (Intercompany Balance Reconciliation)108affected

Weaknesses

  • CWE-15: CWE-15: External Control of System or Configuration Setting

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References