Medium severity · published Feb 10, 2026
CVE-2026-0486
Missing Authorization Check in ABAP based SAP systems
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system information.This has low impact on confidentiality. Integrity and availability are not impacted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
ABAP based SAP systems · SAP_SE
ST-PI 2005_1_700; 2008_1_710; 740; 758 · source: vendor
ST
Solution Tools Plug-in · Sap
740; 758; 2005_1_700; 2008_1_710 · source: NVD