SAP^® Security Advisories

Onapsis Security Advisory 2026-0045: SAP ADS – XFA injection in wsalvpdf Impact on Business An unauthenticated attacker can inject malicious code into the SAP Adobe Document Services (ADS) component. This can lead to the disclosure of sensitive system information and cause a denial of service (DoS) condition, rendering the PDF generation service unavailable and disrupting…

Information Exposure in SAP Bex Workbooks Impact on Business An authenticated attacker can gain unauthorized access to metadata regarding workbooks within the SAP BW system. This exposure of information allows for the enumeration of workbook names and IDs, which could be used to facilitate further targeted actions or information gathering. Vulnerability Details The RFC-enabled function…

Information Disclosure in SAP Business Explorer (BEx) Impact on Business By exploiting this vulnerability, an authenticated attacker can gain unauthorized access to sensitive workplace information belonging to other users. This includes details such as favorite shortcuts, internal URLs, and workbook identifiers. Such information disclosure can be used to map internal business processes or facilitate more…

Improper Access Control in SAP Business Explorer (BEx) Impact on Business By exploiting this vulnerability, an authenticated malicious user can delete workplace favorites nodes belonging to any other user in the system. This can lead to unauthorized modification of user-specific data and disruption of business workflows within the SAP Business Explorer environment. Vulnerability Details A…

SAP Bex – Insert Arbitrary URL inside Favorites Impact on Business An authenticated attacker could exploit this vulnerability to inject arbitrary URLs into the favorites list of any user within the SAP system. This could be leveraged for phishing or social engineering attacks by misleading users into accessing malicious external sites from a trusted interface….

SAP Bex – Insert Arbitrary Workbook inside Favorites Impact on Business An authenticated attacker could exploit this vulnerability to inject unauthorized content into the favorites workplace of other users. This could be used to mislead users or facilitate further attacks by directing them to malicious workbooks, impacting the integrity of the user’s workspace. Vulnerability Details…

SAP Bex – Arbitrary Modification of Favorites Nodes Data Impact on Business An authenticated attacker with low privileges could modify or access data belonging to other users within the SAP Business Explorer (BEx) environment. This could lead to unauthorized data manipulation or access to sensitive workbooks, potentially compromising the integrity and confidentiality of business reports…

Improper Authorization in SAP BEx (Business Explorer) Impact on Business An authenticated attacker with low privileges could gain unauthorized access to sensitive metadata within the SAP system. By exploiting this vulnerability, an attacker can enumerate system usernames, workbook identifiers, and workbook titles. This information disclosure could be used to facilitate further targeted attacks or to…

SAP Software Update Manager (SUM) – Credential Exposure Through Log Files Impact on Business A local attacker with low privileges can retrieve sensitive credentials, such as database or SAP administrator passwords, from log files. This has a high impact on the confidentiality of the system and could allow the attacker to escalate privileges within the…