Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) (SAP_SE SAP Fiori App (Intercompany Balance Reconciliation))
At a glance
- Source
- NVD
- EPSS
- EPSS 0.18 % · percentile 7 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Deferred
Description
SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application.
Weaknesses (CWE)
- CWE-15 — External Control of System or Configuration Setting
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.1 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L | sap |
| CVSS 3.1 | MEDIUM 5.1 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-2391
- GCVE · GCVE-0-2026-0495
CERT-FR advisories
- CERTFR-2026-AVI-0034 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP Fiori App (Intercompany Balance Reconciliation) | affected UIAPFI70 500 ; affected 600 ; affected 700 ; affected 800 ; affected 900 ; affected 901 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |