{"id":"CVE-2026-120015","kind":"vulnerability","aliases":["CVE-2026-120015"],"related":[],"title":"SAP Host Agent: weak input checks let low-privilege users run code","description":"SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successful exploitation could lead to persistent code execution, resulting in a high impact on confidentiality, integrity and availability.","summary":"SAP Host Agent does not sufficiently validate certain inputs, so an attacker with low privileges can make an internal component load a malicious file under a privileged account. Successful exploitation could lead to persistent code execution with high impact on confidentiality, integrity and availability.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP Host Agent","fixed":[],"affected":"SAPHOSTAGENT 7.22 (per OffSeq, unconfirmed by SAP)","ecosystem":"vendor"}],"ecosystems":[],"tags":["cwe-427","infrastructure","sap","sap-host-agent","self-hosted"],"not_affected_if":[],"how_to_check":"Check your SAP Host Agent version on each SAP host (run 'saphostexec -version'). OffSeq lists SAPHOSTAGENT 7.22 as affected. Confirm the affected range and fixed patch level in SAP Security Note 3842766 (SAP for Me, login needed).","fix":null,"status":"open","published_at":"2026-11-10T01:17:16+00:00","first_seen_at":"2026-11-10T01:26:39+00:00","triaged_at":"2026-11-10T01:28:30+00:00","updated_at":"2026-11-10T01:33:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T01:28:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"SAP Host Agent: weak input checks let low-privilege users run code","impact":"high","summary":"SAP Host Agent does not sufficiently validate certain inputs, so an attacker with low privileges can make an internal component load a malicious file under a privileged account. Successful exploitation could lead to persistent code execution with high impact on confidentiality, integrity and availability.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sap","sap-host-agent","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"persistent code execution under a privileged account on the host","analyst_note":"Find the affected SAP Host Agent versions, the fixed patch level and the SAP Security Note for CVE-2026-120015 on the SAP support portal or the NVD entry.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"SAP Host Agent runs on SAP server hosts to manage and monitor SAP systems, so exposure falls on companies running SAP landscapes. The description says exploitation needs low privileges and specific conditions, but the sources do not name the affected versions or the exact conditions. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4548,"output_tokens":487,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected SAP Host Agent versions, the fixed patch level and the SAP Security Note for CVE-2026-120015 on the SAP support portal or the NVD entry.","search":"'-120015':16A,19A '-2026':15A,18A '-427':24B 'abus':96C 'account':61B,113C 'affect':98C 'agent':3A,22A,30B,36B,80C 'attack':45B,91C 'avail':77B,131C 'certain':41B,85C,88C 'check':6A 'code':13A,68B,120C 'compon':53B,104C 'condit':89C 'confidenti':74B,128C 'could':64B,95C,116C 'cve':14A,17A 'cwe':23B 'execut':69B,121C 'exploit':63B,115C 'file':57B,109C 'function':99C 'high':71B,125C 'host':2A,21A,29B,33B,35B,79C 'impact':72B,126C 'influenc':101C 'infrastructur':25B 'input':5A,42B,86C 'integr':75B,129C 'intern':52B,103C 'lead':65B,117C 'let':7A 'load':54B,106C 'low':9A,47B,93C 'low-privileg':8A 'make':50B 'malici':56B,108C 'persist':67B,119C 'privileg':10A,48B,60B,94C,112C 'result':122C 'run':12A 'sap':1A,20A,26B,28B,34B,78C 'sap-host-ag':27B 'self':32B 'self-host':31B 'success':62B,114C 'suffici':39B,83C 'user':11A 'valid':40B,84C 'weak':4A","nicknames":[],"mitigations":[],"who_affected":"SAP Host Agent runs on SAP server hosts to manage and monitor SAP systems, so exposure falls on companies running SAP landscapes. The description says exploitation needs low privileges and specific conditions, but the sources do not name the affected versions or the exact conditions. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["hostagent","saphostagent"],"ptokens":["agent","host","sap"],"labels":["cwe427","high","infrastructure","sap","saphostagent","selfhosted"],"campaign_type":null,"search_a":"'-120015':16A,19A '-2026':15A,18A 'agent':3A,22A 'check':6A 'code':13A 'cve':14A,17A 'host':2A,21A 'input':5A 'let':7A 'low':9A 'low-privileg':8A 'privileg':10A 'run':12A 'sap':1A,20A 'user':11A 'weak':4A","search_b":"'-427':24B 'account':61B 'agent':30B,36B 'attack':45B 'avail':77B 'certain':41B 'code':68B 'compon':53B 'confidenti':74B 'could':64B 'cwe':23B 'execut':69B 'exploit':63B 'file':57B 'high':71B 'host':29B,33B,35B 'impact':72B 'infrastructur':25B 'input':42B 'integr':75B 'intern':52B 'lead':65B 'load':54B 'low':47B 'make':50B 'malici':56B 'persist':67B 'privileg':48B,60B 'sap':26B,28B,34B 'sap-host-ag':27B 'self':32B 'self-host':31B 'success':62B 'suffici':39B 'valid':40B","search_c":"'abus':96C 'account':113C 'affect':98C 'agent':80C 'attack':91C 'avail':131C 'certain':85C,88C 'code':120C 'compon':104C 'condit':89C 'confidenti':128C 'could':95C,116C 'execut':121C 'exploit':115C 'file':109C 'function':99C 'high':125C 'host':79C 'impact':126C 'influenc':101C 'input':86C 'integr':129C 'intern':103C 'lead':117C 'load':106C 'low':93C 'malici':108C 'persist':119C 'privileg':94C,112C 'result':122C 'sap':78C 'success':114C 'suffici':83C 'valid':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120015","severity":null,"published_at":"2026-11-10T01:17:16+00:00","modified_at":"2026-11-10T01:17:16+00:00","first_seen_at":"2026-11-10T01:26:39+00:00","fetched_at":"2026-11-10T01:26:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120015:2384","url":"https://radar.offseq.com/threat/cve-2026-120015-cwe-427-uncontrolled-search-path-element-in-sapse-sap-host-agent-d325615fdcf9bc54","severity":null,"published_at":"2026-11-10T01:33:50+00:00","modified_at":"2026-11-10T01:33:50+00:00","first_seen_at":"2026-11-10T01:33:50+00:00","fetched_at":"2026-11-10T01:33:50+00:00","note":"SAP SE CNA record (CWE-427, uncontrolled search path). Fix is in SAP Security Note 3842766 (me.sap.com/notes/3842766, login required, not readable here). OffSeq lists SAPHOSTAGENT 7.22 affected, no fixed level; secondhand, so nothing verified. Not exploited, no PoC found.","cites":["https://radar.offseq.com/threat/cve-2026-120015-cwe-427-uncontrolled-search-path-element-in-sapse-sap-host-agent-d325615fdcf9bc54"]}],"documents":[{"id":112459,"url":"https://radar.offseq.com/threat/cve-2026-120015-cwe-427-uncontrolled-search-path-element-in-sapse-sap-host-agent-d325615fdcf9bc54","title":"OffSeq: CVE-2026-120015 SAP Host Agent","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}