CVE-2026-0510

Tuesday, January 13, 2026

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

Summary

The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping data. This weakness could allow an attacker with high-privileged access to exploit the vulnerability under specific conditions potentially leading to partial disclosure of sensitive information.This has low impact on confidentiality with no impact on integrity and availability of the application.

Affected Software

Vendor	Product	Version Range	Status
SAP_SE	NW AS Java UME User Mapping	`ENGINEAPI 7.50`	affected
SAP_SE	NW AS Java UME User Mapping	`SERVERCORE 7.50`	affected
SAP_SE	NW AS Java UME User Mapping	`UMEADMIN 7.50`	affected

Weaknesses

CWE-326: CWE-326: Inadequate Encryption Strength

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: partial

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.