CVE-2026-24326 — Missing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations)

Description (CNA)

Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-enabled function modules to do direct update on standard SAP database table . This results in low impact on integrity, with no impact on confidentiality or availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP S/4HANA Defense & Security (Disconnected Operations)	affected EA-DFPS 600; affected 603; affected 604; affected 605; affected 606; affected 616; affected 617; affected 618; affected 619; affected 800; affected 801; affected 802; affected 803; affected 804; affected 805; affected 806; affected 807; affected 808; affected 809

CWE

CWE-862

References

https://me.sap.com/notes/3678009
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.