CVE-2026-40134 — Missing Authorization Check in SAP Incentive and Commission Management

Description (CNA)

Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function module to perform table update operations. This vulnerability has a low impact on integrity with no impact on confidentiality and availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP Incentive and Commission Management	affected SAP_APPL 618; affected S4CORE 102; affected 103; affected 104; affected 105; affected 106; affected 107; affected 108; affected 109; affected EA-APPL 600; affected 604; affected 605; affected 606; affected 617

CWE

CWE-862

References

https://me.sap.com/notes/3718508
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.