Description
SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the attacker to obtain limited information about internal systems, resulting in low impact on confidentiality. There is no impact on integrity and availability.
Published: 2026-10-13
Score: 3.5 Low
EPSS: < 1% Very Low
KEV: No
Impact: Limited information disclosure – low confidentiality impact
Action: Assess
AI Analysis

Impact

SAP Cloud Connector includes an improper authorization check that permits a low‑privileged attacker on an adjacent network to send specially crafted requests. Successful exploitation can reveal limited internal system information, but does not affect integrity or availability. The weakness is cataloged as CWE‑191.

Affected Systems

The vulnerability affects SAP Cloud Connector, as identified by the SAP SE CNA. No specific version range is listed, so all deployed instances that have not applied the latest update may be vulnerable.

Risk and Exploitability

The CVSS score of 3.5 classifies this issue as low severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be on an adjacent network and to target the component with a crafted request, meaning that proper network segmentation can mitigate exposure. Given the low confidentiality impact and lack of integrity or availability compromise, operational risk remains modest but should still be managed.

Generated by OpenCVE AI on October 13, 2026 at 03:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Ensure SAP Cloud Connector is only reachable from trusted, internal networks and not exposed to untrusted adjacent networks.
  • Apply the latest update released by SAP, referenced by SAP Note 3767634 and the SAP Security Patch Day URL.
  • Configure logging and monitoring to detect and alert on unauthorized or suspicious request patterns aimed at the authorization check.

Generated by OpenCVE AI on October 13, 2026 at 03:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Sap
Sap cloud Connector
Vendors & Products Sap
Sap cloud Connector

Tue, 13 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Description SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the attacker to obtain limited information about internal systems, resulting in low impact on confidentiality. There is no impact on integrity and availability.
Title Improper Authorization check in SAP Cloud Connector
Weaknesses CWE-191
References
Metrics cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Sap Cloud Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2026-10-13T13:28:31.692Z

Reserved: 2026-06-29T19:35:04.185Z

Link: CVE-2026-58242

cve-icon Vulnrichment

Updated: 2026-10-13T13:20:14.340Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T01:16:46.073

Modified: 2026-10-15T20:38:04.303

Link: CVE-2026-58242

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:15:15Z

Weaknesses
  • CWE-191

    Integer Underflow (Wrap or Wraparound)