CVE-2026-76960
LowCVSS 3.5Summary
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests. A low-privileged attacker could craft a malicious link or page. If an authenticated victim interacts, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity, with no impact on availability.
Risk Assessment
Risk of unauthorized actions performed in the context of an authenticated user, potentially compromising confidentiality and integrity of financial data.
Recommendation
Implement CSRF protection mechanisms (e.g., tokens) for all sensitive requests and apply patches from SAP.
Other vulnerabilities in SAP S/4HANA Finance
See all- CVE-2026-76961Low
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests. A low-privileged attacker could craft a malicious link or page. If an authenticated victim interacts, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity, with no impact on availability.
- CVE-2026-76959Medium
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests. A low-privileged attacker could craft a malicious link or page. If an authenticated victim interacts, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity, with no impact on availability.
Original NVD description (English source)
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity. There is no impact on availability.