SAP SE SAP Financial Consolidation vulnerabilities

4 CVEs affecting SAP SE SAP Financial Consolidation, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-40136, published 2026-05-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-30016, published 2025-04-08. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. SAP Financial Consolidation allows an unauthenticated attacker to gain unauthorized access to the Admin account. The vulnerability arises due to improper authentication mechanisms, due to which there…
CVE-2026-40136, published 2026-05-12. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing access. However, the application itself cannot be…
CVE-2024-37177, published 2024-06-11. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web…
CVE-2024-37178, published 2024-06-11. Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days. SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exposed over the network. The vulnerability…