CVE-2026-58245

SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to bypass authorization and delete specific planning-related restrictions in the application. Successful exploitation could result in a low impact on confidentiality and integrity, with no impact on availability of the application.

CVSS v3 3.8 LOW

3.8^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3763028
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SAP Advanced Planning y Optimization (Model Mix Planning) contiene una credencial codificada de forma rígida dentro del código fuente de la aplicación para realizar una verificación de autorización para acceder a ciertas funcionalidades en la aplicación. Un atacante con privilegios elevados podría aprovechar esta credencial codificada de forma rígida para eludir la autorización y eliminar restricciones específicas relacionadas con la planificación en la aplicación. La explotación exitosa podría resultar en un impacto bajo en la confidencialidad y la integridad, sin impacto en la disponibilidad de la aplicación.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-58245

Mitre link : CVE-2026-58245

CVE.ORG link : CVE-2026-58245

JSON object : View

Products Affected

No product.

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2026-58245", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58245", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T13:18:01.147615Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.2}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Advanced Planning and Optimization (Model Mix Planning)", "versions": [{"status": "affected", "version": "SCMAPO 713"}, {"status": "affected", "version": "714"}, {"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "S4COREOP 104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}, {"status": "affected", "version": "109"}, {"status": "affected", "version": "SCM 700"}, {"status": "affected", "version": "701"}, {"status": "affected", "version": "702"}, {"status": "affected", "version": "712"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:22.397", "references": [{"url": "https://me.sap.com/notes/3763028", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to bypass authorization and delete specific planning-related restrictions in the application. Successful exploitation could result in a low impact on confidentiality and integrity, with no impact on availability of the application."}, {"lang": "es", "value": "SAP Advanced Planning y Optimization (Model Mix Planning) contiene una credencial codificada de forma r\u00edgida dentro del c\u00f3digo fuente de la aplicaci\u00f3n para realizar una verificaci\u00f3n de autorizaci\u00f3n para acceder a ciertas funcionalidades en la aplicaci\u00f3n. Un atacante con privilegios elevados podr\u00eda aprovechar esta credencial codificada de forma r\u00edgida para eludir la autorizaci\u00f3n y eliminar restricciones espec\u00edficas relacionadas con la planificaci\u00f3n en la aplicaci\u00f3n. La explotaci\u00f3n exitosa podr\u00eda resultar en un impacto bajo en la confidencialidad y la integridad, sin impacto en la disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "cna@sap.com"}