CVE-2026-0503

MEDIUM

SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) - Missing Authorization Check

Title source: llm
STIX 2.1

Description

Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-text credentials and bypass the password authentication check by manipulating user parameters. Upon successful exploitation, the attacker can access, modify or delete certain change pointer information within EHS objects in the application which might further affect the subsequent systems. This vulnerability leads to a low impact on confidentiality and integrity of the application with no affect on the availability.

References (2)

Core 2
Core References

Scores

CVSS v3 6.4
EPSS 0.0007
EPSS Percentile 21.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (12)
SAP_SE/SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) 103
SAP_SE/SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) 104
SAP_SE/SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) 105
SAP_SE/SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) 106
SAP_SE/SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) 107
SAP_SE/SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) 108
SAP_SE/SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) 109
SAP_SE/SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) 606
SAP_SE/SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) 617
SAP_SE/SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) EA-APPL 605
... and 2 more
Published Jan 13, 2026
Tracked Since Feb 18, 2026