HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2026-23687

CVSS 8.8v3.1pub. 2026-02-10upd. 2026-06-09

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized access to sensitive user data and potential disruption of normal system usage.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Sap Basis

    APP
    Sap
    700701702731740750751752753754755756757758804+ 3 more
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2025-0066CRITICAL9.9PL ✓same product

SAP NetWeaver AS ABAP – nieautoryzowany dostęp do danych przez słabą kontrolę dostępu

CVE-2025-0063HIGH8.8same product

SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC functio...

CVE-2016-4551HIGH7.5same product

The (1) SAP_BASIS and (2) SAP_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote atta...

CVE-2026-0484MEDIUM6.5same product

Debido a la falta de verificación de autorización en SAP NetWeaver Application Server ABAP y SAP S/4HANA, un a...

CVE-2026-24312MEDIUM5.2same product

Błędna kontrola autoryzacji w SAP Business Workflow prowadzi do privilege escalation. Uwierzytelniony użytkown...