CVE-2026-58245

{
  "id": "CVE-2026-58245",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T01:17:22.397",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to bypass authorization and delete specific planning-related restrictions in the application. Successful exploitation could result in a low impact on confidentiality and integrity, with no impact on availability of the application."
    },
    {
      "lang": "es",
      "value": "SAP Advanced Planning y Optimization (Model Mix Planning) contiene una credencial codificada de forma rígida dentro del código fuente de la aplicación para realizar una verificación de autorización para acceder a ciertas funcionalidades en la aplicación. Un atacante con privilegios elevados podría aprovechar esta credencial codificada de forma rígida para eludir la autorización y eliminar restricciones específicas relacionadas con la planificación en la aplicación. La explotación exitosa podría resultar en un impacto bajo en la confidencialidad y la integridad, sin impacto en la disponibilidad de la aplicación."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Advanced Planning and Optimization (Model Mix Planning)",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "SCMAPO 713",
              "status": "affected"
            },
            {
              "version": "714",
              "status": "affected"
            },
            {
              "version": "S4CORE 102",
              "status": "affected"
            },
            {
              "version": "103",
              "status": "affected"
            },
            {
              "version": "104",
              "status": "affected"
            },
            {
              "version": "S4COREOP 104",
              "status": "affected"
            },
            {
              "version": "105",
              "status": "affected"
            },
            {
              "version": "106",
              "status": "affected"
            },
            {
              "version": "107",
              "status": "affected"
            },
            {
              "version": "108",
              "status": "affected"
            },
            {
              "version": "109",
              "status": "affected"
            },
            {
              "version": "SCM 700",
              "status": "affected"
            },
            {
              "version": "701",
              "status": "affected"
            },
            {
              "version": "702",
              "status": "affected"
            },
            {
              "version": "712",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 3.8,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T13:18:01.147615Z",
          "id": "CVE-2026-58245",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://me.sap.com/notes/3763028",
      "source": "[email protected]"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "[email protected]"
    }
  ]
}