CVE-2026-0493: CSRF in SAP Fiori App (Intercompany Balance)

The CSRF vulnerability allows an attacker to craft malicious requests that appear to originate from a legitimate, authenticated user. By tricking a user into clicking a crafted link or visiting a malicious website, the attacker can execute state-changing actions within the SAP Fiori App Intercompany Balance Reconciliation. This could involve unauthorized modifications to financial data, creation of fraudulent transactions, or other actions that compromise the integrity of the system. While the vulnerability does not directly impact confidentiality or availability, the potential for data manipulation poses a significant risk to financial reporting and operational processes. Exploitation could lead to inaccurate financial statements and potential regulatory non-compliance.

1. Reserved2025-12-09
2. Published2026-01-13
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0493 is to upgrade to SAP Fiori App (Intercompany Balance Reconciliation) version 4.0.1 or later. Prior to upgrading, it is crucial to review SAP's upgrade documentation and test the upgrade in a non-production environment to ensure compatibility and avoid disruptions. As a temporary workaround, implement strict input validation and output encoding within the application to minimize the risk of CSRF attacks. Consider implementing CSRF tokens or other anti-CSRF mechanisms to protect sensitive actions. Regularly review application logs for suspicious activity and implement robust access controls to limit user privileges.