SAP November patch day fixes four CVSS 10.0 flaws
Unauthenticated memory corruption in ICM and Web Dispatcher may allow code execution; exploitation is not discussed.
70
CVE-2026-120015
Untrusted file load in SAP Host Agent
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
SAP Host Agent does not sufficiently validate certain inputs. An attacker with low privileges can, over the network and under certain conditions, cause an internal component to load a malicious file under a privileged account. Successful abuse can yield persistent code execution with high impact on confidentiality, integrity, and availability. SAP has not listed affected builds.
What to do: Apply SAP's update for CVE-2026-120015. No workaround is stated.
| Product | Affected |
|---|---|
| SAP Host Agent | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successful exploitation could lead to persistent code execution, resulting in a high impact on confidentiality, integrity and availability.
- Weakness
- CWE-427
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H