CVE-2026-40134 - Vulnerability Details - OpenCVE

Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function module to perform table update operations. This vulnerability has a low impact on integrity with no impact on confidentiality and availability of the application.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Sap Se	Sap Incentive And Commission Management

No data.

No data.

References

Link	Providers
https://www.spirityenterprise.com/sap-hana
https://www.spirityenterprise.com/sap-hana-migration
https://me.sap.com/notes/3718508
https://url.sap/sapsecuritypatchday

History

Tue, 12 May 2026 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Sap Se Sap Se sap Incentive And Commission Management
Vendors & Products		Sap Se Sap Se sap Incentive And Commission Management

Tue, 12 May 2026 03:00:00 +0000

Type	Values Removed	Values Added
Description		Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function module to perform table update operations. This vulnerability has a low impact on integrity with no impact on confidentiality and availability of the application.
Title		Missing Authorization Check in SAP Incentive and Commission Management
Weaknesses		CWE-862
References		https://me.sap.com/notes/3718508 https://url.sap/sapsecuritypatchday
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: sap

Published: 2026-05-12T02:21:28.424Z

Updated: 2026-05-12T13:11:34.915Z

Reserved: 2026-04-09T17:29:44.663Z

Link: CVE-2026-40134

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-05-12T03:16:12.307

Modified: 2026-05-12T03:16:12.307

Link: CVE-2026-40134

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40134", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-04-09T17:29:44.663Z", "datePublished": "2026-05-12T02:21:28.424Z", "dateUpdated": "2026-05-12T13:11:34.915Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-05-12T02:21:28.424Z"}, "title": "Missing Authorization Check in SAP Incentive and Commission Management", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Incentive and Commission Management", "versions": [{"status": "affected", "version": "SAP_APPL 618"}, {"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}, {"status": "affected", "version": "109"}, {"status": "affected", "version": "EA-APPL 600"}, {"status": "affected", "version": "604"}, {"status": "affected", "version": "605"}, {"status": "affected", "version": "606"}, {"status": "affected", "version": "617"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function module to perform table update operations. This vulnerability has a low impact on integrity with no impact on confidentiality and availability of the application.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function module to perform table update operations. This vulnerability has a low impact on integrity with no impact on confidentiality and availability of the application.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3718508"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-12T13:11:28.563457Z", "id": "CVE-2026-40134", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T13:11:34.915Z"}}]}}