CVE-2026-23687

Katalog CVE

CVSS 8.8 · High EPSS 0,50%

Kerentanan Improper Verification of Cryptographic Signature pada sap basis. Skor CVSS 3.1 8.8 (High) menurut sap.com.

Deskripsi (NVD)

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized access to sensitive user data and potential disruption of normal system usage.

Rincian

Terbit di NVD

10 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber sap.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://url.sap/sapsecuritypatchday advisory vendor
• https://me.sap.com/notes/3697567 permissions required
• http://seclists.org/fulldisclosure/2026/Jun/1