Quick answers
- Is CVE-2026-76961 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-76961 being exploited in the wild.
- How severe is CVE-2026-76961?
- Low severity, with a CVSS score of 3.5, published 8 September 2026.
- Which products and versions are affected?
- SAP S/4HANA Finance <UNKNOWN>.
- Is there a fix for CVE-2026-76961?
- A patch was published on 2026-09-08: SAP Security Note 3371336 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-76961 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-76961?
- Check whether you run SAP S/4HANA Finance at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a Cross-Site Request Forgery (CSRF) flaw in SAP S/4HANA Finance's Advanced Payment Management component, which fails to implement sufficient CSRF token validation on certain sensitive requests. The attack requires an authenticated user to be socially engineered into visiting a malicious page or clicking a malicious link while logged into the vulnerable system; no additional privilege escalation is needed beyond the attacker's existing low-level access. An attacker can craft requests that would be executed in the context of the victim's authenticated session, allowing them to perform unintended actions such as modifying payment data or initiating unauthorized transactions. The vulnerability has a reported CVSS score of 3.5 (low) and is not known to be actively exploited in the wild. A patch is available via SAP Security Note 3371336.
Affected products
- SAP S/4HANA Finance <UNKNOWN>
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: SAP Security Note 3371336