Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Reconciliation)

The CSRF vulnerability allows an attacker to craft malicious requests that appear to originate from a legitimate, authenticated user. By tricking a user into clicking a crafted link or visiting a malicious website, the attacker can execute state-changing actions within the SAP Fiori App Intercompany Balance Reconciliation. This could involve unauthorized modifications to financial data, creation of fraudulent transactions, or other actions that compromise the integrity of the system. While the vulnerability does not directly impact confidentiality or availability, the potential for data manipulation poses a significant risk to financial reporting and operational processes. Exploitation could lead to inaccurate financial statements and potential regulatory non-compliance.

Organizations utilizing the SAP Fiori App Intercompany Balance Reconciliation application, particularly those running versions prior to 4.0.1, are at risk. This includes companies with complex intercompany transactions and those relying on accurate financial reporting. Shared hosting environments where multiple tenants share the same SAP instance may also be vulnerable if proper isolation measures are not in place.

• sap: Examine SAP application logs for unusual request patterns, particularly those involving Intercompany Balance Reconciliation functionality. Look for requests originating from unexpected IP addresses or user agents.

zgrep "Intercompany Balance Reconciliation" /var/log/sap/app/<SID>/<instance>/trace.txt

1. 2026-01-13Disclosure

   disclosure

1. Reserviert2025-12-09
2. Veröffentlicht2026-01-13
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-0493 is to upgrade to SAP Fiori App (Intercompany Balance Reconciliation) version 4.0.1 or later. Prior to upgrading, it is crucial to review SAP's upgrade documentation and test the upgrade in a non-production environment to ensure compatibility and avoid disruptions. As a temporary workaround, implement strict input validation and output encoding within the application to minimize the risk of CSRF attacks. Consider implementing CSRF tokens or other anti-CSRF mechanisms to protect sensitive actions. Regularly review application logs for suspicious activity and implement robust access controls to limit user privileges.