CVE-2026-23687

Summary

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized access to sensitive user data and potential disruption of normal system usage.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 700affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 701affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 702affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 731affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 740affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 750affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 751affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 752affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 753affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 754affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 755affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 756affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 757affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 758affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 804affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 816affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 916affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 917affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 918affected

Weaknesses

  • CWE-347: CWE-347: Improper Verification of Cryptographic Signature

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

CVE Program Container

Additional References

References