{"affected":[{"defaultStatus":"unaffected","product":"SAP Host Agent","source":"CNA: sap","vendor":"SAP_SE","versions":[{"status":"affected","version":"SAPHOSTAGENT 7.22"}]}],"cveId":"CVE-2026-120015","cwes":["CWE-427"],"description":"SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successful exploitation could lead to persistent code execution, resulting in a high impact on confidentiality, integrity and availability.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: sap","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794271353031,"publishedAt":1794271353031,"references":[{"source":"CNA: sap","tags":[],"url":"https://me.sap.com/notes/3842766"},{"source":"CNA: sap","tags":[],"url":"https://url.sap/sapsecuritypatchday"}],"remediation":[],"revision":"6eb766dd1830de3e12201076c8af5b31966169481f480c157e48ed229b424409","sources":[{"modifiedAt":1794271353031,"name":"CNA: sap","retrievedAt":1794272931051,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120015"}],"ssvc":null,"status":"published","title":"Insufficient Input Validation in SAP Host Agent","updatedAt":1794272931051}