SAP Note 3842766: SAP Host Agent Input Validation (CVE-2026-120015)

SAP Host Agent Input Validation: CVE-2026-120015 · CVSS 3.0 7.5 · SAP Note 3842766

SAP Host Agent runs on every SAP host with high operating system privileges. Note 3842766 fixes insufficient input validation in it. Under a specific condition, a low-privileged attacker can make an internal component load a malicious file under a privileged account. As a result, successful exploitation gives persistent code execution on the host. SAP rates the SAP Host Agent Input Validation issue at CVSS 7.5, High. In this post, we cover exposure, the fix and what to check.

SAP Host Agent Input Validation: condition

According to SAP, this exploit requires a specialised SAP-internal monitoring configuration on the Host Agent. That narrows real-world exposure. However, most landscapes do not track Host Agent configuration closely, so verify rather than assume.

Fix

Upgrade to SAP Host Agent 7.22 PL72 or later. See SAP Note 2219592 for the upgrade strategy and 1031096 for installation. In addition, you can update Host Agent centrally through its own update mechanism, so this is usually a quick change. Unfortunately, no workaround exists for this issue.

Why Host Agent matters

Host Agent runs as root or as a local administrator on every SAP host. Consequently, code execution through it bypasses every SAP-level control. Moreover, a persistent foothold on one host often leads to others, since SAP hosts share admin accounts and file systems. So the SAP Host Agent Input Validation fix deserves quick rollout despite the narrow condition.

What to check

First, list the Host Agent version on every host, for example with saphostctrl -function ExecuteOperation -name versioninfo. Next, update any instance below 7.22 PL72. Finally, enable automatic Host Agent updates where your change process allows it, so future fixes after the SAP Host Agent Input Validation note arrive without manual work.

SAP Host Agent Input Validation: advisory details

Component: BC-CCM-HAG
SAP priority: High
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 5
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: SAP Security Note 3842766 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.