medium2026-05-12SAP S/4HANACVE-2026-40134
Missing Authorization Check in SAP Incentive & Commission Management
SAP Incentive & Commission Management
Our Take
Sales compensation data is sensitive — even if low severity, the audit and HR implications matter. Planned window.
Vulnerability Detail
Missing authorisation check in the Incentive & Commission Management functionality allows an authenticated attacker to access or modify incentive-related data without proper permissions.
Patch Action
Apply SAP Note 3718508.
Affected Versions
S4CORE 102–109
Patch Info