Medium severity · published Feb 10, 2026
CVE-2026-0486
In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system…
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of system information.This has low impact on confidentiality. Integrity and availability are not impacted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Solution Tools Plug-in · Sap
740; 758; 2005_1_700; 2008_1_710 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-0486
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-0486
Permissions Required
https://me.sap.com/notes/3691645
Vendor Advisory
https://url.sap/sapsecuritypatchday
More from Solution Tools Plug-in
7.7
CVE-2026-24322
SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing sensitive information to…
4.3
CVE-2026-23681
Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to retrieve information…