CVE-2026-24327: SAP SEM Information Disclosure Flaw

CVE-2026-24327 Overview

CVE-2026-24327 is a missing authorization check vulnerability in SAP Strategic Enterprise Management, specifically within the Balanced Scorecard component of Business Server Pages (BSP). An authenticated attacker can leverage the flaw to access information they are not otherwise permitted to view. The weakness is classified under CWE-862: Missing Authorization and affects multiple releases of the product spanning versions 600 through 800.

Exploitation requires valid credentials but no user interaction, and the scope is limited to confidentiality. Integrity and availability of the affected SAP system are not impacted by this issue.

Critical Impact
Authenticated attackers can retrieve sensitive Balanced Scorecard data from SAP Strategic Enterprise Management without proper authorization, exposing internal performance and planning information across affected SAP releases.

Affected Products

SAP Strategic Enterprise Management versions 600, 602, 603, 604, 605, and 634
SAP Strategic Enterprise Management versions 700, 736, 746, 747, and 748
SAP Strategic Enterprise Management version 800

Discovery Timeline

2026-02-10 - CVE-2026-24327 published to NVD
2026-02-17 - Last updated in NVD database

Technical Details for CVE-2026-24327

Vulnerability Analysis

The vulnerability resides in the Balanced Scorecard functionality delivered through Business Server Pages (BSP) within SAP Strategic Enterprise Management. BSP applications execute server-side logic to render dynamic content from the SAP NetWeaver Application Server ABAP stack. In the affected component, the application processes requests without verifying that the requesting user holds the authorization objects required to view the targeted scorecard data.

Because SAP authorization checks are explicit rather than implicit, any code path that omits the corresponding AUTHORITY-CHECK statement allows authenticated callers to bypass intended access controls. The flaw exposes confidentiality only, with no write or denial-of-service consequences.

Root Cause

The root cause is a missing authorization check (CWE-862) in the BSP handler that serves Balanced Scorecard data. The handler does not validate the user's role assignments or authorization objects against the requested object before returning data. As a result, the application returns information regardless of whether the caller belongs to a role intended to read it.

Attack Vector

The attack is network-based and requires a low-privileged authenticated session against the SAP BSP runtime. An attacker with a valid SAP user account sends crafted HTTP requests to the Balanced Scorecard BSP endpoint and retrieves data belonging to scorecards outside their authorization scope. No user interaction or elevated privileges are required to trigger the missing check.

The vulnerability is described in prose only; SAP has not published exploit details, and no public proof-of-concept is currently available. Refer to SAP Note #3680390 for vendor-supplied technical information.

Detection Methods for CVE-2026-24327

Indicators of Compromise

Unusual HTTP GET or POST requests from low-privileged SAP user accounts to Balanced Scorecard BSP paths within SAP Strategic Enterprise Management.
SAP Security Audit Log entries showing successful access to BSP applications by users without Balanced Scorecard role assignments.
Spikes in BSP request volume from a single authenticated session correlated with enumeration of scorecard object identifiers.

Detection Strategies

Enable and review the SAP Security Audit Log (transaction SM19/RSAU_CONFIG) for access events tied to Strategic Enterprise Management BSP applications.
Correlate ICM/HTTP access logs with user role assignments from transaction SUIM to identify access by accounts lacking the relevant authorization objects.
Hunt for repeated BSP requests that iterate scorecard identifiers, which can indicate enumeration of unauthorized objects.

Monitoring Recommendations

Forward SAP Security Audit Log and ICM HTTP logs to a centralized analytics platform for retention and correlation across users and sessions.
Alert on authenticated SAP users accessing BSP applications outside their assigned business role profiles.
Track changes to authorization objects and role assignments in Strategic Enterprise Management to validate that least-privilege models remain intact after patching.

How to Mitigate CVE-2026-24327

Immediate Actions Required

Apply the patch referenced in SAP Note #3680390 to all affected SAP Strategic Enterprise Management instances.
Review which user accounts have access to the Balanced Scorecard BSP application and revoke entitlements that are not required for current job functions.
Audit SAP Security Audit Log entries for prior access to the affected component to identify potential exposure before the patch was applied.

Patch Information

SAP released a fix as part of its monthly Security Patch Day cycle. Administrators should download and apply SAP Note #3680390 and consult the SAP Security Patch Day portal for deployment guidance and prerequisites. The patch introduces the missing authorization check in the Balanced Scorecard BSP handler.

Workarounds

Restrict network access to the affected BSP application path through SAP Web Dispatcher or reverse proxy access control rules until the patch is deployed.
Tighten role and authorization object assignments for the Balanced Scorecard component so that only required users retain access.
Disable the Balanced Scorecard BSP application via transaction SICF in environments where the functionality is not actively used.

bash

# Configuration example: disable an unused BSP service in SAP via SICF
# Transaction: SICF
# Navigate: /default_host/sap/bc/bsp/sap/<balanced_scorecard_service>
# Right-click the service node and select: Deactivate Service
# Verify status shows the service as inactive before saving