Export of Exchange Profile contains password, SAP security note 1418010

SAP Note 1418010

SAP security note 1418010, "Export of Exchange Profile contains password", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

User credentials are disclosed during the export of data from the Exchange Profile. This poses a potential information disclosure vulnerability within the application.

Solution

Apply the relevant patches as specified below.

References

Affected components

SAP_XITOOL for release NW04/NW04S
SAP NetWeaver PI 7.1
SAP EHP1 for SAP PI NetWeaver 7.1 and further releases

Full note on SAP: SAP Support Launchpad note 1418010

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Exchange Profile #Information Disclosure #SAP NetWeaver PI #Password Disclosure

Explore More

CVE-2026-58240 security alert cover, CVSS base score 9.8 critical, SAP message server missing authentication

SAP Note 3759472: SAP Message Server Authentication Gap (CVE-2026-58240)

September 8, 2026

SAP Note 3759472 CVE-2026-58240 SAP Message Server Patch Day September 2026 SAP Security Note 3759472 | CVSS 3.0 base score 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVE-2026-44756 security alert cover, CVSS base score 10.0 critical, SAP Extended Passport stack overflow

SAP Note 3747649: SAP Extended Passport Overflow (CVE-2026-44756)

September 8, 2026

SAP Note 3747649 CVE-2026-44756 SAP NetWeaver Kernel Patch Day September 2026 SAP Security Note 3747649 | CVSS 3.0 base score 10.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

SAP Security Patch Day September 2026 cover image from RedRays

SAP Security Patch Day September 2026 | RedRays

September 8, 2026

SAP Security Patch Day September 2026 brings 20 security notes, four of them HotNews rated up to CVSS 10.0, alongside five High

SAP Note 3765948 cover image, code injection and SSRF vulnerability analysis of CVE-2026-44772 in SAP MII

SAP Note 3765948: Code Injection via SSRF in SAP MII (CVE-2026-44772)

August 11, 2026

CVE-2026-44772, CVSS 9.9: XSL transform parameters let an authenticated user make SAP MII fetch and execute a remote stylesheet. The gate ships disabled.