Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-120014

CSRF in SAP HANA XSA Web Dispatcher admin functions

CVSS 3.1
7.6 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-120014 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP HANA XSA Web Dispatcher does not sufficiently validate requests in certain administrative functions, enabling cross-site request forgery. An unauthenticated attacker can trick a logged-on administrator into opening a malicious link, which then performs unintended actions in that session. Success can temporarily compromise the dispatcher, with high impact on confidentiality and partial impact on integrity and availability. SAP has not listed affected builds.

What to do: Apply SAP's update for CVE-2026-120014. SAP has not named a fixed version or workaround.

ProductAffected
SAP HANA XSA Web Dispatcher—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a temporary compromise of the SAP HANA XSA Web Dispatcher, resulting in a high impact on confidentiality, and partial impact on integrity, and availability.

Weakness
CWE-352
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories