Cyber Resilience

CVE-2026-40136

Published
12 May 2026
Modified
17 June 2026
CVSS Score v3.1 4.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0029 21th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-40136 is a medium-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Sap (inferred from references). Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-12 (Session Termination) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing access. However, the application itself cannot be compromised resulting in a low impact on availability. There is no impact on confidentiality and integrity…

more

of the data

CWE(s)
CWE-404

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Authenticated session termination enables application-layer DoS via exploitation of improper resource handling (CWE-404).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-8120Shared CWE-404
CVE-2026-7707Shared CWE-404
CVE-2023-5324Shared CWE-404
CVE-2025-14747Shared CWE-404
CVE-2025-11642Shared CWE-404
CVE-2026-2525Shared CWE-404
CVE-2025-1377Shared CWE-404
CVE-2025-1376Shared CWE-404
CVE-2026-8222Shared CWE-404
CVE-2026-4240Shared CWE-404

Affected Assets

Sap
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-12 Session Termination
  • AC-6 Least Privilege
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Enforces authorization checks on session-management functions so an authenticated user cannot terminate other users' sessions.

AC-12 Session Termination good match
prevent

Requires explicit, controlled session termination logic that prevents arbitrary or cross-user session kills.

AC-6 Least Privilege partial match
prevent

Restricts session-termination privileges to only those accounts that require them, limiting the attack surface for CWE-404 abuse.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include coding standards for correct resource allocation and release.

DE.CM-09 partial match
prevents

Runtime monitoring can detect resource exhaustion caused by improper shutdown or release.

ID.AM-08 partial match
prevents

Lifecycle management of assets can encompass proper resource release at end-of-life or shutdown.

PR.IR-04 partial match
prevents

Capacity management helps surface leaks from unreleased resources but does not prevent the coding flaw.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.37 Documented operating procedures partial match
prevents

Including restart, recovery and media-handling instructions reduces the likelihood that resources or sensitive data will be left in an exposed or improperly released state after a failure.

References