CVE-2025-26657

SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability.

Score

CVSS 3.1 5.3 Medium

Status

Deferred - cna@sap.com

Published

2025-04-08

Last modified

2025-04-08

Weaknesses

CWE-862

Affected products

• Sap Kmc Wpc (Sap Se)

References

• https://me.sap.com/notes/3568307
• https://url.sap/sapsecuritypatchday