Log in Start free

Vulnerability · Published Apr 14, 2026 · Assigned by sap

CVE-2026-34264Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA

Medium 6.5

In plain English

A medium-severity security flaw in SAP Human Capital Management for SAP S/4HANA from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 80.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information causing a high impact on confidentiality, while integrity and availability are unaffected.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP Human Capital Management for SAP S/4HANA S4HCMRXX 100101102SAP_HRRXX 600604608

Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References