---
id: "CVE-2026-120015"
page: "https://infrastack.ai/live/CVE-2026-120015"
kind: "vulnerability"
aliases: ["CVE-2026-120015"]
title: "SAP Host Agent: weak input checks let low-privilege users run code"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "SAP Host Agent", "fixed": [], "affected": "SAPHOSTAGENT 7.22 (per OffSeq, unconfirmed by SAP)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cwe-427", "infrastructure", "sap", "sap-host-agent", "self-hosted"]
not_affected_if: []
published_at: "2026-11-10T01:17:16+00:00"
first_seen_at: "2026-11-10T01:26:39+00:00"
updated_at: "2026-11-10T01:33:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120015", "first_seen_at": "2026-11-10T01:26:39+00:00"}, {"source": "analyst", "url": "https://radar.offseq.com/threat/cve-2026-120015-cwe-427-uncontrolled-search-path-element-in-sapse-sap-host-agent-d325615fdcf9bc54", "first_seen_at": "2026-11-10T01:33:50+00:00", "cites": ["https://radar.offseq.com/threat/cve-2026-120015-cwe-427-uncontrolled-search-path-element-in-sapse-sap-host-agent-d325615fdcf9bc54"]}]
exploit_sources: []
---

# SAP Host Agent: weak input checks let low-privilege users run code

Link for people: https://infrastack.ai/live/CVE-2026-120015 (this .md is for agents)

SAP Host Agent does not sufficiently validate certain inputs, so an attacker with low privileges can make an internal component load a malicious file under a privileged account. Successful exploitation could lead to persistent code execution with high impact on confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP Host Agent affected SAPHOSTAGENT 7.22 (per OffSeq, unconfirmed by SAP) fixed no fixed version listed

## How to check

Check your SAP Host Agent version on each SAP host (run 'saphostexec -version'). OffSeq lists SAPHOSTAGENT 7.22 as affected. Confirm the affected range and fixed patch level in SAP Security Note 3842766 (SAP for Me, login needed).

## Timeline

- 2026-11-10T01:26:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120015
- 2026-11-10T01:33:50+00:00 analyst https://radar.offseq.com/threat/cve-2026-120015-cwe-427-uncontrolled-search-path-element-in-sapse-sap-host-agent-d325615fdcf9bc54 — SAP SE CNA record (CWE-427, uncontrolled search path). Fix is in SAP Security Note 3842766 (me.sap.com/notes/3842766, login required, not readable here). OffSeq lists SAPHOSTAGENT 7.22 affected, no fixed level; secondhand, so nothing verified. Not exploited, no PoC found.

## Documents

- [describes] OffSeq: CVE-2026-120015 SAP Host Agent https://radar.offseq.com/threat/cve-2026-120015-cwe-427-uncontrolled-search-path-element-in-sapse-sap-host-agent-d325615fdcf9bc54

## From the sources

SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successful exploitation could lead to persistent code execution, resulting in a high impact on confidentiality, integrity and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_