SAP Financial Consolidation can be disrupted when an authenticated attacker terminates other users’ sessions, temporarily blocking their access. The application itself remains uncompromised and no confidentiality or integrity breach occurs; only a low-impact interruption of availability is observed.

The vendor is SAP and the affected product is SAP Financial Consolidation. No specific product versions were listed in the advisory.

With a CVSS score of 4.3, this vulnerability is classified as low severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, implying limited exploitation evidence. The likely attack vector requires an authenticated session, meaning the attacker must first obtain valid credentials before triggering the denial of service. The absence of a public fix or workaround suggests that the risk is primarily mitigated by restricting session‑termination privileges and monitoring for abnormal activity.