Missing authorization in SAP Enterprise Financial Services
Priority LOW 39CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Why it matters now
EPSS 0.0078 56th percentileScored 2026-11-07
Fix Fixed SAP Enterprise Financial Services (Bank Customer Accounts) (SAP SE): 101, 102, 103 +11
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Enterprise Financial Services (Bank Customer Accounts) | before 101; before 102; before 103; before 104; before 105; before 600; before 603; before 604; before 605; before 606; before 616; before 617; before 618; before 800 | 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800 | Patch available | CNA |
- SAP Enterprise Financial Services (Bank Customer Accounts) VendorSAP Affected before 101; before 102; before 103; before 104; before 105; before 600; before 603; before 604; before 605; before 606; before 616; before 617; before 618; before 800 Fixed in 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800 Patch available CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:enterprise_financial_services:1.01:*:*:*:*:*:*:* | 1.01 | Vulnerable | SAP |
| cpe:2.3:a:sap:enterprise_financial_services:1.02:*:*:*:*:*:*:* | 1.02 | Vulnerable | SAP |
| cpe:2.3:a:sap:enterprise_financial_services:1.03:*:*:*:*:*:*:* | 1.03 | Vulnerable | SAP |
| cpe:2.3:a:sap:enterprise_financial_services:1.04:*:*:*:*:*:*:* | 1.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:enterprise_financial_services:1.05:*:*:*:*:*:*:* | 1.05 | Vulnerable | SAP |
| cpe:2.3:a:sap:enterprise_financial_services:6.00:*:*:*:*:*:*:* | 6.00 | Vulnerable | SAP |
| cpe:2.3:a:sap:enterprise_financial_services:6.03:*:*:*:*:*:*:* | 6.03 | Vulnerable | SAP |
| cpe:2.3:a:sap:enterprise_financial_services:6.04:*:*:*:*:*:*:* | 6.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:enterprise_financial_services:6.05:*:*:*:*:*:*:* | 6.05 | Vulnerable | SAP |
| cpe:2.3:a:sap:enterprise_financial_services:6.06:*:*:*:*:*:*:* | 6.06 | Vulnerable | SAP |
- cpe:2.3:a:sap:enterprise_financial_services:1.01:*:*:*:*:*:*:* Versions 1.01 Vulnerable ·SAP
- cpe:2.3:a:sap:enterprise_financial_services:1.02:*:*:*:*:*:*:* Versions 1.02 Vulnerable ·SAP
- cpe:2.3:a:sap:enterprise_financial_services:1.03:*:*:*:*:*:*:* Versions 1.03 Vulnerable ·SAP
- cpe:2.3:a:sap:enterprise_financial_services:1.04:*:*:*:*:*:*:* Versions 1.04 Vulnerable ·SAP
- cpe:2.3:a:sap:enterprise_financial_services:1.05:*:*:*:*:*:*:* Versions 1.05 Vulnerable ·SAP
- cpe:2.3:a:sap:enterprise_financial_services:6.00:*:*:*:*:*:*:* Versions 6.00 Vulnerable ·SAP
- cpe:2.3:a:sap:enterprise_financial_services:6.03:*:*:*:*:*:*:* Versions 6.03 Vulnerable ·SAP
- cpe:2.3:a:sap:enterprise_financial_services:6.04:*:*:*:*:*:*:* Versions 6.04 Vulnerable ·SAP
- cpe:2.3:a:sap:enterprise_financial_services:6.05:*:*:*:*:*:*:* Versions 6.05 Vulnerable ·SAP
- cpe:2.3:a:sap:enterprise_financial_services:6.06:*:*:*:*:*:*:* Versions 6.06 Vulnerable ·SAP
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:enterprise_financial_services:6.16:*:*:*:*:*:*:* | 6.16 | Vulnerable | SAP |
| cpe:2.3:a:sap:enterprise_financial_services:6.17:*:*:*:*:*:*:* | 6.17 | Vulnerable | SAP |
| cpe:2.3:a:sap:enterprise_financial_services:6.18:*:*:*:*:*:*:* | 6.18 | Vulnerable | SAP |
| cpe:2.3:a:sap:enterprise_financial_services:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | SAP |
- cpe:2.3:a:sap:enterprise_financial_services:6.16:*:*:*:*:*:*:* Versions 6.16 Vulnerable ·SAP
- cpe:2.3:a:sap:enterprise_financial_services:6.17:*:*:*:*:*:*:* Versions 6.17 Vulnerable ·SAP
- cpe:2.3:a:sap:enterprise_financial_services:6.18:*:*:*:*:*:*:* Versions 6.18 Vulnerable ·SAP
- cpe:2.3:a:sap:enterprise_financial_services:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·SAP
Remediation
- Fix · CNA SAP Enterprise Financial Services (Bank Customer Accounts) (SAP SE) Fixed in 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21486
- 2026-10-03 Alias added: GHSA-6g9h-vg2g-h3mq
References
More SAP Enterprise Financial Services vulnerabilities
- TI-2018-01835 Missing authorization in SAP Enterprise Financial Services CVSS 3.0HIGH 8.8
- TI-2018-01834 Missing authorization in SAP Enterprise Financial Services CVSS 3.0HIGH 8.8
Sources
- CVE-2021-21486 · CVE Program
- CVE-2021-21486 · NVD
- FIRST EPSS
- GHSA-6g9h-vg2g-h3mq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences