Medium severity · published Feb 24, 2026
CVE-2026-24314
Information Disclosure vulnerability in S/4HANA (Manage Payment Media)
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
S/4HANA (Manage Payment Media) · SAP_SE
UIAPFI70 600; 700; 800; 900; 901; 902; +1 more · source: vendor
SU
S/4hana Uiapfi70 · Sap
600; 700; 800; 900; 901; 902 · source: NVD
SU
S/4hana Uis4h · Sap
109 · source: NVD