HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2026-23687

CVSS 8.8v3.1pub. 2026-02-10upd. 2026-06-09

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized access to sensitive user data and potential disruption of normal system usage.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Sap Basis

    APP
    Sap
    700701702731740750751752753754755756757758804+ 3 więcej
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2025-0066CRITICAL9.9PL ✓ten sam produkt

SAP NetWeaver AS ABAP – nieautoryzowany dostęp do danych przez słabą kontrolę dostępu

CVE-2025-0063HIGH8.8ten sam produkt

SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC functio...

CVE-2016-4551HIGH7.5ten sam produkt

The (1) SAP_BASIS and (2) SAP_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote atta...

CVE-2026-0484MEDIUM6.5ten sam produkt

Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated ...

CVE-2026-24312MEDIUM5.2ten sam produkt

An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated admi...