CVE-2026-23687
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
SAP NetWeaver Application Server ABAP and ABAP Platform allow an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may lead to acceptance of tampered identity information and unauthorized access to sensitive user data.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data and disruptions in normal system usage, potentially leading to serious legal and financial consequences.
Recommendation
It is recommended to implement additional verification and monitoring mechanisms for signed XML documents to prevent unauthorized modifications by users.
Other vulnerabilities in SAP NetWeaver Application Server ABAP, ABAP Platform
See all- CVE-2023-37492Medium
SAP NetWeaver Application Server ABAP and ABAP Platform in versions from 700 to 804 do not perform necessary authorization checks for an authenticated user, resulting in privilege escalation. This could allow an attacker to access sensitive information that can be used in a subsequent serious attack.
- CVE-2023-35874Medium
SAP NetWeaver Application Server ABAP and ABAP Platform in versions KRNL64NUC, 7.22 and KERNEL 7.22-7.93 perform improper authentication checks for functionalities requiring user identity. As a result, an attacker can perform malicious actions over the network.
Original NVD description (English source)
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized access to sensitive user data and potential disruption of normal system usage.