SAP S/4HANA MBC Auth Bypass Delete Entry
CVE-2026-76962 Published on September 8, 2026
Missing Authorization check in SAP S/4HANA (Manage Bank Chains app)
SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially crafted requests to delete specific entries that should not be accessible to them. This results in a low impact on availability. There is no impact on confidentiality and integrity.
Vulnerability Analysis
CVE-2026-76962 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-76962 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-76962
Want to know whenever a new CVE is published for SAP S4hana? stack.watch will email you.
Affected Versions
SAP_SE SAP S/4HANA (Manage Bank Chains app):- Version S4CORE 107 is affected.
- Version 108 is affected.
- Version 109 is affected.