CVE-2025-26655

3.1 lowEPSS 0.2%

Low (3.1). EPSS 0.2% chance of exploitation in the next 30 days.

SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise be restricted, potentially causing a low impact on the integrity of the application.Confidentiality and Availability are not impacted.

Severity

CVSS 3.1

3.1 low

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2025-03-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://me.sap.com/notes/3347991
https://url.sap/sapsecuritypatchday

Check your stack JSON