Security readout for executives and security teams
Plain-English summary
CVE-2026-0493 is a medium-severity CSRF issue in SAP Fiori App Intercompany Balance Reconciliation. It could let an attacker cause unintended state-changing actions as an authenticated user. Reported impact is limited to low integrity impact, with no confidentiality or availability impact.
Executive priority
Treat as a routine but important SAP patch-cycle item. It affects integrity of financial reconciliation workflows, but published impact is low and there is no cited active exploitation. Confirm exposure and remediate through SAP guidance during the next appropriate maintenance window, sooner for sensitive finance systems.
Technical view
The vulnerability is CWE-352 in SAP Fiori App Intercompany Balance Reconciliation. The issue involves state-changing actions using an inappropriate request type, deviating from expected request semantics. CVSS is 4.3, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. Affected versions are listed across UIAPFI70, S4CORE, and UIS4H components.
Likely exposure
Organizations using SAP Fiori App Intercompany Balance Reconciliation on the listed UIAPFI70, S4CORE, or UIS4H versions may be exposed. Systems not running this app or affected component versions are less likely to be affected. The CVE record lists default status as unaffected outside the named versions.
Exploitation context
No CISA KEV listing or source evidence of active exploitation was provided. The described scenario requires an attacker to act against an authenticated user's session to trigger unintended changes. The stated business impact is limited integrity risk, not data theft or service outage.
Researcher notes
Evidence is limited to the CVE record and SAP references. The CVE describes CSRF caused by improper request semantics for state-changing actions. Do not assume broader SAP product impact beyond the listed components and versions. SAP Note 3655229 is the key authoritative remediation reference.
Mitigation direction
- Review SAP Note 3655229 for official remediation guidance.
- Check SAP Security Patch Day information for available fixes or instructions.
- Prioritize affected production finance and reconciliation environments.
- Apply SAP-provided updates or configuration guidance if your versions match.
- If not immediately patching, monitor for unusual reconciliation changes.
Validation and detection
- Inventory SAP systems running Intercompany Balance Reconciliation.
- Compare installed UIAPFI70, S4CORE, and UIS4H versions against the affected list.
- Confirm whether SAP Note 3655229 applies to each system.
- Verify SAP patch status through standard SAP maintenance tooling.
- Review change logs for unexpected state-changing reconciliation actions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0493 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://me.sap.com/notes/3655229CVE reference
- https://url.sap/sapsecuritypatchdayCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.