Is CVE-2026-40132 actively exploited?

No active exploitation of CVE-2026-40132 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-40132 be exploited remotely?

Yes. CVE-2026-40132 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-40132?

CVE-2026-40132 has a CVSS score of 5.4 (MEDIUM).

HOME VULNERABILITIESCVE-2026-40132

MEDIUM

CVE-2026-40132

CWE-862Published: May 12, 2026· Updated: May 12, 2026

5.4

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.8th

Official Description

Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This vulnerability also enables the attacker to change the default settings and modify value fields, which will mislead risk evaluations and falsely lower assessed risk levels. This results in a low impact on the confidentiality and integrity of the data. There is no impact on the application�s availability.

NVD Source

Technical Analysis

CVE-2026-40132 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.