# CVE-2026-76961: SAP S/4HANA Finance CSRF protection bypass in Advanced Payment Management

Source: https://junglewise.ai/threats/cve-2026-76961-sap-s-4hana-finance-csrf-protection-bypass-in-advanced-payment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76961 · Severity: low · CVSS 3.5 · Published 2026-09-08

SAP S/4HANA Finance's Advanced Payment Management module is missing proper Cross-Site Request Forgery (CSRF) protections on certain requests. An attacker with low privileges could trick an authenticated user into clicking a malicious link or visiting a crafted webpage, which would execute unintended payment or financial transactions on the victim's behalf. This could result in unauthorized financial actions, though the overall impact is limited to low-level confidentiality and integrity concerns with no availability impact.

Technologies: [SAP S/4HANA Finance](https://junglewise.ai/threats/technologies/s-4hana-finance). Vendors: [SAP](https://junglewise.ai/threats/vendors/sap).

## Quick answers

**Is CVE-2026-76961 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76961 being exploited in the wild.

**How severe is CVE-2026-76961?** Low severity, with a CVSS score of 3.5, published 8 September 2026.

**Which products and versions are affected?** SAP S/4HANA Finance <UNKNOWN>.

**Is there a fix for CVE-2026-76961?** A patch was published on 2026-09-08: SAP Security Note 3371336 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76961 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-76961?** Check whether you run SAP S/4HANA Finance at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Cross-Site Request Forgery (CSRF) flaw in SAP S/4HANA Finance's Advanced Payment Management component, which fails to implement sufficient CSRF token validation on certain sensitive requests. The attack requires an authenticated user to be socially engineered into visiting a malicious page or clicking a malicious link while logged into the vulnerable system; no additional privilege escalation is needed beyond the attacker's existing low-level access. An attacker can craft requests that would be executed in the context of the victim's authenticated session, allowing them to perform unintended actions such as modifying payment data or initiating unauthorized transactions. The vulnerability has a reported CVSS score of 3.5 (low) and is not known to be actively exploited in the wild. A patch is available via SAP Security Note 3371336.

## Affected products

- SAP S/4HANA Finance <UNKNOWN>

## Timeline

- 2026-09-08: disclosed
- 2026-09-08: patched: SAP Security Note 3371336

## References

- [https://me.sap.com/notes/3371336](https://me.sap.com/notes/3371336)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)

## Related threats

- [SAP S/4HANA Finance Cross-Site Request Forgery in Advanced Payment Management](https://junglewise.ai/threats/cve-2026-76960-sap-s-4hana-finance-cross-site-request-forgery-in-advanced)
- [SAP S/4HANA Finance Advanced Payment Management CSRF protection bypass](https://junglewise.ai/threats/cve-2026-76959-sap-s-4hana-finance-advanced-payment-management-csrf-protection)