CVE-2026-0511

High

Published: 13 January 2026

Published

13 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0004 12.8th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0511 is a high-severity Missing Authorization (CWE-862) vulnerability in Sap (inferred from references). Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 12.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Directly mandates enforcement of approved authorizations for access to information and resources, addressing the core issue of missing authorization checks enabling privilege escalation in the SAP Fiori app.

AC-6 Least Privilege good match

prevent

Employs the principle of least privilege to restrict authenticated users to only necessary accesses, mitigating the high confidentiality and integrity impacts from privilege escalation.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and correction of flaws like the missing authorization vulnerability, enabling application of SAP security note 3565506 to prevent exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Missing authorization (CWE-862) directly enables remote privilege escalation from low-priv authenticated access in a network-exposed SAP Fiori web app.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has high impact on confidentiality and integrity of the application ,availability is not impacted.

Deeper analysisAI

CVE-2026-0511 is a missing authorization vulnerability (CWE-862) in the SAP Fiori App Intercompany Balance Reconciliation. The application fails to perform necessary authorization checks for authenticated users, enabling privilege escalation. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high impact on confidentiality and integrity with no effect on availability. The vulnerability was published on 2026-01-13.

An authenticated attacker with low privileges can exploit this issue remotely over the network with low complexity and no user interaction required. Successful exploitation allows escalation of privileges, potentially granting unauthorized access to sensitive data and enabling modifications that compromise the application's confidentiality and integrity.

SAP has addressed this vulnerability through security note 3565506, available at https://me.sap.com/notes/3565506, as part of the SAP Security Patch Day detailed at https://url.sap/sapsecuritypatchday. Security practitioners should apply the recommended patches promptly to mitigate the risk.