CVE-2022-26102: sap_se sap netweaver application server for abap Missing Authorization
Vulnerability summary
CVE-2022-26102 is a medium (CVSS 5.5) Missing Authorization vulnerability in sap_se sap netweaver application server for abap. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.3% of scored vulnerabilities.
Timeline
- 08-03-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access content on the start screen of any transaction that is available with in the same SAP system even if he/she isn't authorized for that transaction. A successful exploitation could expose information and in worst case manipulate data before the start screen is executed, resulting in limited impact on confidentiality and integrity of the application.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.49%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.49% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Sap1 product
- netweaver_application_server_abap700 | 701 | 702 | 731
Sap_se1 product
- sap netweaver application server for abap< 700 | < 701 | < 702 | < 731
2 vendors · 2 products