CVE-2025-27436: SAP SE SAP s/4hana Manage Bank Statements

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact with a resource is legitimate, allowing the attacker to delete the attachment of a posted bank statement. This leads to a low impact on integrity, with no impact on the confidentiality of the data or the availability of the application.

Affected products

• SAP SE SAP s/4hana Manage Bank Statements: version S4CORE 107 only; version 108 only

Published 2025-03-11. Last modified 2026-06-17.