CVE-2026-24326: SAP s/4hana Defense & Security

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-enabled function modules to do direct update on standard SAP database table . This results in low impact on integrity, with no impact on confidentiality or availability of the application.

Affected products

• SAP s/4hana Defense & Security: version 600 only; version 603 only; version 604 only; version 605 only; version 606 only; version 616 only; …

Published 2026-02-10. Last modified 2026-06-17.