CVE-2026-76961CWE-352csrf

CVE-2026-76961

Low · published September 8, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
2.8
In the wild
Unconfirmed
What it is

SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results in a low impact on confidentiality and integrity. There is no impact on availability.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00136 · 2.8th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-09-08T05:17Z
References (2)
https://me.sap.com/notes/3371336 · [email protected]https://url.sap/sapsecuritypatchday · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 00:12Z
    Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)
    cvelistv5