CVE-2026-0503

Summary

Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-text credentials and bypass the password authentication check by manipulating user parameters. Upon successful exploitation, the attacker can access, modify or delete certain change pointer information within EHS objects in the application which might further affect the subsequent systems. This vulnerability leads to a low impact on confidentiality and integrity of the application with no affect on the availability.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP ERP Central Component and SAP S/4HANA (SAP EHS Management)SAP_APPL 618affected
SAP_SESAP ERP Central Component and SAP S/4HANA (SAP EHS Management)S4CORE 102affected
SAP_SESAP ERP Central Component and SAP S/4HANA (SAP EHS Management)103affected
SAP_SESAP ERP Central Component and SAP S/4HANA (SAP EHS Management)104affected
SAP_SESAP ERP Central Component and SAP S/4HANA (SAP EHS Management)105affected
SAP_SESAP ERP Central Component and SAP S/4HANA (SAP EHS Management)106affected
SAP_SESAP ERP Central Component and SAP S/4HANA (SAP EHS Management)107affected
SAP_SESAP ERP Central Component and SAP S/4HANA (SAP EHS Management)108affected
SAP_SESAP ERP Central Component and SAP S/4HANA (SAP EHS Management)109affected
SAP_SESAP ERP Central Component and SAP S/4HANA (SAP EHS Management)EA-APPL 605affected
SAP_SESAP ERP Central Component and SAP S/4HANA (SAP EHS Management)606affected
SAP_SESAP ERP Central Component and SAP S/4HANA (SAP EHS Management)617affected

Weaknesses

  • CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References