# CVE-2026-76960: SAP S/4HANA Finance Cross-Site Request Forgery in Advanced Payment Management

Source: https://junglewise.ai/threats/cve-2026-76960-sap-s-4hana-finance-cross-site-request-forgery-in-advanced  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76960 · Severity: low · CVSS 3.5 · Published 2026-09-08

SAP S/4HANA Finance's Advanced Payment Management module handles financial transactions and payment approvals. A weakness in CSRF protections allows an attacker to trick authenticated users into performing unintended actions (such as approving payments or modifying payment terms) by visiting a malicious link or page. This could result in unauthorized transactions or data tampering.

Technologies: [SAP S/4HANA Finance](https://junglewise.ai/threats/technologies/s-4hana-finance). Vendors: [SAP](https://junglewise.ai/threats/vendors/sap).

## Quick answers

**Is CVE-2026-76960 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76960 being exploited in the wild.

**How severe is CVE-2026-76960?** Low severity, with a CVSS score of 3.5, published 8 September 2026.

**Which products and versions are affected?** SAP S/4HANA Finance <UNKNOWN>.

**Is there a fix for CVE-2026-76960?** A patch was published on 2026-09-08: SAP Security Patch Day Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76960 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76960?** Check whether you run SAP S/4HANA Finance at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Cross-Site Request Forgery (CSRF) flaw in SAP S/4HANA Finance's Advanced Payment Management module that lacks sufficient CSRF token validation on certain sensitive requests. An attacker with low privileges can craft a malicious link or webpage that, when visited by an authenticated victim, causes the victim's browser to perform unintended actions on the finance system. Attack preconditions include the victim being authenticated to S/4HANA and clicking a malicious link or visiting an attacker-controlled page. The impact is limited to low-severity confidentiality and integrity concerns; availability is not affected. Patches are available as SAP Security Notes per the regular Security Patch Day schedule.

## Affected products

- SAP S/4HANA Finance <UNKNOWN>

## Timeline

- 2026-09-08: disclosed
- 2026-09-08: patched: SAP Security Patch Day

## References

- [https://me.sap.com/notes/3365276](https://me.sap.com/notes/3365276)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)

## Related threats

- [SAP S/4HANA Finance CSRF protection bypass in Advanced Payment Management](https://junglewise.ai/threats/cve-2026-76961-sap-s-4hana-finance-csrf-protection-bypass-in-advanced-payment)
- [SAP S/4HANA Finance Advanced Payment Management CSRF protection bypass](https://junglewise.ai/threats/cve-2026-76959-sap-s-4hana-finance-advanced-payment-management-csrf-protection)