CVE-2025-26657: SAP SE SAP Kmc Wpc

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability.

Affected products

• SAP SE SAP Kmc Wpc

Published 2025-04-08. Last modified 2026-06-17.