HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2026-23689

CVSS 7.7v3.1pub. 2026-02-10upd. 2026-02-17

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

  • Sap Advanced Planning And Optimization

    APP
    Sap
    713714

  • Sap Supply Chain Management

    APP
    Sap
    700701702712
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
DoS
CWE
References

Related vulnerabilities

CVE-2025-42999CRITICAL9.1⚠ KEVPL ✓ten sam vendor

SAP NetWeaver Visual Composer — niebezpieczna deserializacja treści

CVE-2025-31324CRITICAL10.0⚠ KEVPL ✓ten sam vendor

SAP NetWeaver: nieautoryzowany upload plików wykonywalnych w Visual Composer

CVE-2022-22536CRITICAL10.0⚠ KEVten sam vendor

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Serve...

CVE-2021-38163CRITICAL9.9⚠ KEVten sam vendor

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker aut...

CVE-2020-6287CRITICAL10.0⚠ KEVten sam vendor

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authen...