CVE-2026-76960
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity. There is no impact on availability.
Scoring
- Severity
- LOW
- CVSS base score
- 3.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
- EPSS probability
- 0.09%
- CWE
- CWE-352
- Published
- 2026-09-08
- Last modified
- 2026-09-08
Affected products
- SAP_SE SAP S/4HANA (Finance for Advanced Payment Management)
- SAP_SE SAP S/4HANA (Finance for Advanced Payment Management)
- SAP_SE SAP S/4HANA (Finance for Advanced Payment Management)
Weakness type
Related vulnerabilities
- CVE-2026-78083 — Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4
- CVE-2026-78084 — Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4
- CVE-2026-87449 — Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36...
- CVE-2026-9215 — A CSRF vulnerability exists in certain NETGEAR XR series devices
- CVE-2026-86724 — AVideo YPTWallet saveBalance.php Cross-Site Request Forgery
- CVE-2026-86719 — WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking
- CVE-2026-86718 — WWBN AVideo Cross-Site Request Forgery via deleteHistory.json.php
- CVE-2026-86135 — Dimension CSRF Vulnerability in Database Snapshot Creation Allows Denial of Service