CVE-2026-40133: SAP S/4HANA Authorization Bypass Vulnerability

CVE-2026-40133 Overview

CVE-2026-40133 is a missing authorization check [CWE-862] in SAP S/4HANA Condition Maintenance. An authenticated attacker can view and modify condition table records without proper authorization validation. The flaw produces low impact on confidentiality, integrity, and availability of affected data. Exploitation may also block legitimate users from accessing records they are entitled to use.

SAP documented the issue in SAP Note #3718083 and released a fix through the SAP Security Patch Day cycle. The vulnerability was published to the National Vulnerability Database (NVD) on 2026-05-12.

Critical Impact
Authenticated users can bypass authorization controls in Condition Maintenance to read and tamper with pricing and condition data that drives SAP S/4HANA business processes.

Affected Products

SAP S/4HANA Condition Maintenance component
Specific supported package versions referenced in SAP Note #3718083
Deployments exposing Condition Maintenance functionality to authenticated users

Discovery Timeline

2026-05-12 - CVE-2026-40133 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-40133

Vulnerability Analysis

The vulnerability resides in the Condition Maintenance component of SAP S/4HANA. Condition Maintenance manages condition tables used for pricing, output determination, and related business logic. The component fails to enforce authorization checks before allowing read and write operations on condition table records.

An attacker who already holds valid SAP credentials can invoke the affected functionality over the network. No user interaction is required, and the attack complexity is low. The result is unauthorized disclosure and modification of condition records that should be restricted to specific roles.

Because condition tables feed pricing and determination logic, tampering can propagate into downstream sales, procurement, and output processes. The vulnerability can also produce denial conditions for legitimate users when records are altered or locked unexpectedly.

Root Cause

The root cause is a missing authorization check [CWE-862]. The Condition Maintenance code path does not call the required AUTHORITY-CHECK logic before performing record access. Role assignments and authorization objects intended to restrict the operation are therefore not evaluated.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. An attacker uses a standard SAP client session, RFC call, or HTTP-based interface exposed by Condition Maintenance. The attacker then issues read or modify requests against condition table records that their assigned role should not permit.

No authenticated proof-of-concept has been published. The EPSS probability is 0.013%, indicating low predicted exploitation activity at disclosure. Refer to the SAP Note #3718083 for component-level technical details.

Detection Methods for CVE-2026-40133

Indicators of Compromise

Unexpected modifications to condition table records by users whose roles do not include Condition Maintenance authorizations
Audit log entries showing successful Condition Maintenance access from accounts outside the pricing or master data teams
Reports from end users that previously accessible condition records are missing, locked, or altered

Detection Strategies

Enable and review the SAP Security Audit Log for Condition Maintenance transactions and related RFC modules
Correlate change document tables for condition records against expected role assignments
Compare user authorization profiles to actual transaction usage to surface privilege mismatches

Monitoring Recommendations

Forward SAP Security Audit Log and change document events to a centralized SIEM for continuous review
Alert on write operations to condition tables originating from non-pricing roles
Track failed and successful authorization checks tied to Condition Maintenance objects after applying the patch

How to Mitigate CVE-2026-40133

Immediate Actions Required

Apply the SAP-provided correction referenced in SAP Note #3718083 during the next available change window
Review users assigned to Condition Maintenance roles and remove access that is not business-justified
Audit recent changes to condition table records and revert any unauthorized modifications

Patch Information

SAP released a security correction for CVE-2026-40133 as part of the SAP Security Patch Day cycle. Customers should consult SAP Note #3718083 for the exact support package or note implementation steps applicable to their S/4HANA release. Additional context is available in the SAP Security Patch Day Announcement.

Workarounds

Restrict network access to Condition Maintenance interfaces to trusted administrative segments until the patch is deployed
Tighten role assignments so that only required users retain change authorization on condition tables
Increase audit logging on condition table change documents to detect abuse during the remediation window

bash

# Configuration example
# Review SAP Note #3718083 for the exact support package and manual steps for your S/4HANA release