8.8

CVE-2026-23687

XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized access to sensitive user data and potential disruption of normal system usage.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Sap Basis Version700
SAP ≫ Sap Basis Version701
SAP ≫ Sap Basis Version702
SAP ≫ Sap Basis Version731
SAP ≫ Sap Basis Version740
SAP ≫ Sap Basis Version750
SAP ≫ Sap Basis Version751
SAP ≫ Sap Basis Version752
SAP ≫ Sap Basis Version753
SAP ≫ Sap Basis Version754
SAP ≫ Sap Basis Version755
SAP ≫ Sap Basis Version756
SAP ≫ Sap Basis Version757
SAP ≫ Sap Basis Version758
SAP ≫ Sap Basis Version804
SAP ≫ Sap Basis Version916
SAP ≫ Sap Basis Version917
SAP ≫ Sap Basis Version918
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.02% 0.053
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cna@sap.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

https://me.sap.com/notes/3697567
Permissions Required