Security readout for executives and security teams
Plain-English summary
This SAP Fiori app flaw lets a highly privileged user upload files without proper file-type checks, including script files. The published impact is low across confidentiality, integrity, and availability, but the issue still matters because it affects a financial reconciliation app and involves privileged upload capability.
Executive priority
Handle in the normal SAP security patch cycle, with faster action for systems exposed to many privileged users or sensitive finance workflows. The risk is moderated by the high-privilege requirement and low stated impact, but privileged upload flaws deserve timely control review.
Technical view
CVE-2026-0496 is a CWE-434 unrestricted file upload issue in SAP Fiori App Intercompany Balance Reconciliation. CVSS 3.1 is 6.6: network-accessible, low complexity, high privileges required, no user interaction, scope changed, and low CIA impact. The record does not state code execution or public exploitation.
Likely exposure
Exposure is limited to listed SAP Fiori App Intercompany Balance Reconciliation components: UIAPFI70 500, 600, 700, 800, 900, 901, 902 and S4CORE 102 through 108. Systems not running these components are not indicated as affected in the provided record.
Exploitation context
No CISA KEV listing or cited source indicates active exploitation. An attacker would need high privileges and network access to the application. The main concern is improper file validation on uploads by privileged users, not unauthenticated compromise.
Researcher notes
The public CVE data is concise and does not describe exploit outcomes beyond arbitrary file upload, including script files. Do not assume remote code execution from the record alone. SAP Note 3565506 is the key vendor source for remediation specifics.
Mitigation direction
- Review SAP Note 3565506 for official correction, prerequisites, and deployment guidance.
- Follow SAP Security Patch Day guidance for affected UIAPFI70 and S4CORE components.
- Restrict and review high-privilege accounts allowed to use the upload function.
- Monitor uploads for unexpected file types until SAP guidance is applied.
Validation and detection
- Inventory SAP systems for listed UIAPFI70 and S4CORE component versions.
- Confirm whether Intercompany Balance Reconciliation Fiori app is deployed and accessible.
- Review roles granting upload capability in the affected app.
- Check change records for application of SAP Note 3565506 guidance.
- Inspect logs for unusual uploads by privileged accounts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0496 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L2.33.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.6MediumVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://me.sap.com/notes/3565506CVE reference
- https://url.sap/sapsecuritypatchdayCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.