CVE-2026-120015
Received Received - Intake

SAP Host Agent Path Traversal Vulnerability

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successful exploitation could lead to persistent code execution, resulting in a high impact on confidentiality, integrity and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-120015
EUVD
EUVD-2026-120698

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap host_agent *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP Host Agent has insufficient input validation. An attacker with low privileges could exploit this to trick the system into loading a malicious file under a privileged account. This could lead to persistent code execution, allowing full control over the system's confidentiality, integrity, and availability.

Detection Guidance

The provided CVE context does not include specific detection methods or commands for identifying this vulnerability on a network or system. SAP Host Agent issues may require checking logs for unusual file loads or privileged account activities.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain persistent control over your SAP Host Agent. This may result in unauthorized access to sensitive data, system manipulation, or disruption of services, affecting confidentiality, integrity, and availability of your systems.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest security patches from SAP as referenced in SAP Note 3842766. Restrict access to the SAP Host Agent to authorized users only. Monitor logs for unusual file access or execution patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120015. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...