Transaction calls from reporting, SAP security note 1493634

SAP Note 1493634

SAP security note 1493634, "Transaction calls from reporting". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

In transaction SA38 (reporting), other transactions are called without a prior authorization check.

Solution

Implement the advanced correction or import the relevant Support Package.

CVSS

Score 4.0 Vector: AV:N/AC:L/AU:S/C:P/I:N/A:N

References

This note refers to

SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Referenced by

SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

SAP_BASIS 620 to 640
SAP_BASIS 700 to 702
SAP_BASIS 710 to 730
SAP_BASIS 72L to 800

Full note on SAP: SAP Support Launchpad note 1493634

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#SAP_BASIS #Transaction authorization #SA38 #Reporting

Explore More

SAP Integration Suite and CAP Security Scan | RedRays

July 23, 2026

Product update Clean core is doing its job: custom logic keeps moving off the ABAP stack. But it does not disappear, it

SAP Security Patch Day July 2026 | RedRays

July 14, 2026

SAP has released its July 2026 security patch package containing 19 security notes addressing vulnerabilities across enterprise SAP environments. This release is

SAP Note 3704740: Missing Authorization Check (CVE-2026-27688)

July 6, 2026

SAP Security Note – Deep Dive SAP Note 3704740 closes a missing authorization check in SAP NetWeaver Application Server for ABAP that

SAP Note 3703856: Missing Authorization Check (CVE-2026-24309)

July 6, 2026

SAP Security Note – Patch Advisory SAP Note 3703856 fixes a missing authorization check in the SAP NetWeaver Application Server for ABAP.