CVE-2026-23681

published 2026-02-10

CVE-2026-23681: Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to…

Priority P4 23 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to retrieve information about the system and its configuration. This disclosure of the system information could assist the attacker to plan subsequent attacks. This vulnerability has a low impact on the confidentiality of the application, with no effect on its integrity or availability.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
sap	solution_tools_plug-in	—	—
sap	solution_tools_plug-in	—	—
sap	solution_tools_plug-in	—	—
sap	solution_tools_plug-in	—	—
sap_se	sap_support_tools_plug-in	—	—
sap_se	sap_support_tools_plug-in	—	—
sap_se	sap_support_tools_plug-in	—	—
sap_se	sap_support_tools_plug-in	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-862