SAP s/4 Hana vulnerabilities

7 CVEs affecting SAP s/4 Hana, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-0498, published 2026-01-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-26832, published 2020-12-09. High severity, CVSS 7.6. EPSS: 2.2% chance of exploitation in the next 30 days. SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA (SAP Landscape Transformation),…
CVE-2020-6188, published 2020-02-12. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103, 104) do not perform…
CVE-2023-41369, published 2023-09-12. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file…
CVE-2026-0498, published 2026-01-13. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary…
CVE-2023-41368, published 2023-09-12. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to change the checkbook name by simulating an update OData call.
CVE-2024-45282, published 2024-10-08. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an OData entity representing assumably…
CVE-2024-34691, published 2024-06-11. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact…