CVE-2026-0512

MediumCVSS 6.1

Published: 14/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, results in execution of malicious content within the victim's browser. This could allow the attacker to access and modify information, impacting confidentiality and integrity while availability remains unaffected.

Risk Assessment

An attacker could access and modify information, compromising the application's confidentiality and integrity; availability remains unaffected. Organizations running vulnerable SAP SRM versions are at risk.

Recommendation

Apply SAP security updates for SAP SRM. Additionally, deploy Content-Security-Policy headers and educate users about suspicious links.

Other vulnerabilities in SAP Supplier Relationship Management

CVE-2023-39436Medium
In SAP Supplier Relationship Management versions 600, 602, 603, 604, 605, 606, 616, 617, there is a vulnerability that allows an unauthorized attacker to discover information related to SRM within Vendor Master Data. This information could be used to tailor attacks against SRM.

Original NVD description (English source)

Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL, that if accessed by a victim, results in execution of malicious content within the victim's browser. This could allow the attacker to access and modify information, impacting the confidentiality and integrity of the application, while availability remains unaffected.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS