CVE-2026-120015: Insufficient Input Validation in SAP Host Agent
SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successful exploitation could lead to persistent code execution, resulting in a high impact on confidentiality, integrity and availability.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must already have low-level privileges. The attack can be performed remotely and does not require user interaction, but the attack complexity is rated high.
What is the likely impact of a successful exploit?
A successful attacker could cause an internal component to load a malicious file under a privileged account, enabling persistent code execution. This can have high impact on confidentiality, integrity, and availability.
What should teams use to identify and remediate affected deployments?
Review SAP Note 3842766 and the SAP Security Patch Day reference for affected configurations and remediation guidance. The provided data does not identify affected versions or available workaround details.