CVE-2026-76960: Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity. There is no impact on availability.
Affected Software
Event History
Frequently Asked Questions
What must an attacker have and what must a victim do for exploitation to succeed?
The attacker needs low privileges and must craft a malicious link or page. Exploitation also requires an authenticated victim to interact with that content.
What is the expected impact if this issue is exploited?
An attacker can cause unintended actions on the web server on the victim's behalf. The stated impact is low confidentiality and integrity impact, with no availability impact.
Which component is affected?
The affected software is SAP S/4HANA Finance, specifically the Advanced Payment Management component.