CVE-2026-0503 — Missing Authorization check in in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management)

Description (CNA)

Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-text credentials and bypass the password authentication check by manipulating user parameters. Upon successful exploitation, the attacker can access, modify or delete certain change pointer information within EHS objects in the application which might further affect the subsequent systems. This vulnerability leads to a low impact on confidentiality and integrity of the application with no affect on the availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP ERP Central Component and SAP S/4HANA (SAP EHS Management)	affected SAP_APPL 618; affected S4CORE 102; affected 103; affected 104; affected 105; affected 106; affected 107; affected 108; affected 109; affected EA-APPL 605; affected 606; affected 617

CWE

CWE-862

References

https://me.sap.com/notes/3681523
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.