CVE-2025-26655

LOW

SAP Just In Time - Authenticated Privilege Escalation via Missing Authorization

Title source: llm
STIX 2.1

Description

SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise be restricted, potentially causing a low impact on the integrity of the application.Confidentiality and Availability are not impacted.

References (2)

Core 2
Core References

Scores

CVSS v3 3.1
EPSS 0.0014
EPSS Percentile 34.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (7)
SAP_SE/SAP Just In Time 103
SAP_SE/SAP Just In Time 104
SAP_SE/SAP Just In Time 105
SAP_SE/SAP Just In Time 106
SAP_SE/SAP Just In Time 107
SAP_SE/SAP Just In Time ECC-DIMP 618
SAP_SE/SAP Just In Time S4CORE 102
Published Mar 11, 2025
Tracked Since Feb 18, 2026