CVE-2026-120017
CRITICAL
INFO
Priority: 0.03
BB Relevance:
80/100
Published: 2026-11-10
Modified: 2026-11-11
First seen: 2026-11-10
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Changed
C:
High
I:
High
A:
High
Description
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.
Weakness Classification (1)
Affected Software (48)
Showing 30 of 48 entries