CVE-2026-24326

Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-enabled function modules to do direct update on standard SAP database table . This results in low impact on integrity, with no impact on confidentiality or availability of the application.

• sap s\/4hana defense \& security 600 • sap s\/4hana defense \& security 603 • sap s\/4hana defense \& security 604 • sap s\/4hana defense \& security 605 • sap s\/4hana defense \& security 606 • sap s\/4hana defense \& security 616 • sap s\/4hana defense \& security 617 • sap s\/4hana defense \& security 618 • sap s\/4hana defense \& security 619 • sap s\/4hana defense \& security 800 • sap s\/4hana defense \& security 801 • sap s\/4hana defense \& security 802 • sap s\/4hana defense \& security 803 • sap s\/4hana defense \& security 804 • sap s\/4hana defense \& security 805 • sap s\/4hana defense \& security 806 • sap s\/4hana defense \& security 807 • sap s\/4hana defense \& security 808 • sap s\/4hana defense \& security 809