Skip to content
Sign in
CVE-2026-12001710.0Critical

CVE-2026-120017: Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)

SAP_SE · SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)

No fix listed · Affected: SAP_SE SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.09 (9 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public: not seen
  5. Not establishedNothing in the sources we check

No EPSS score yet. The score appears once FIRST publishes it.

10.0CriticalCVSS
LowCrit.

DescriptionNVD

SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.

Coverage2 articles · 2 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 10 Nov.

Full timeline
Developinglatest 5 hours ago2 articles2 outlets
10 Nov · SecurityOnline firstNow
  • Tue 10 Nov, 03:01 UTC. SecurityOnline, first report. SAP fixes 38 flaws, including nine critical vulnerabilities.
  • Tue 10 Nov, 11:00 UTC. The Hacker News, its first report on the story. SAP patches four maximum severity flaws across its systems.
All coveragerunning total2SecurityOnl…1The Hacker…110 NovNow
  • First report
  • Article
  • Running total
Show as table
2 articles about CVE-2026-120017 from 2 outlets
Published (UTC)OutletHeadline
10 Nov 03:01SecurityOnlineSAP fixes 38 flaws, including nine critical vulnerabilities
10 Nov 11:00The Hacker NewsSAP patches four maximum severity flaws across its systems
  1. SAP patches four maximum severity flaws across its systems
    The Hacker News · mentions it in passing
  2. SAP fixes 38 flaws, including nine critical vulnerabilities
    SecurityOnline · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in