CVE-2025-26658: Broken Authentication in SAP Business One (Service Layer)
Description
The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unauthorized actions. Due to the improper session management, the attackers can elevate themselves to higher privilege and can read, modify and/or write new data. To gain authenticated sessions of other users, the attacker must invest considerable time and effort. This vulnerability has a high impact on the confidentiality and integrity of the application with no effect on the availability of the application.
Classification
CVE ID: CVE-2025-26658
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.8
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Problem Types
CWE-384: Session FixationAffected Products
Vendor: SAP_SE
Product: SAP Business One (Service Layer)
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.03% (probability of being exploited)
EPSS Percentile: 6.56% (scored less or equal to compared to others)
EPSS Date: 2025-04-08 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-26658https://me.sap.com/notes/3561045
https://url.sap/sapsecuritypatchday