{"id":"CVE-2026-120015","published":"2026-11-10T01:17:16.537","lastModified":"2026-11-10T22:11:23.807","description":"SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successful exploitation could lead to persistent code execution, resulting in a high impact on confidentiality, integrity and availability.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-427"],"vendors":[],"products":[],"references":[{"url":"https://me.sap.com/notes/3842766","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}