CVE-2026-120017 · Runtime
NO FIX YET
SAP NetWeaver AS ABAP and ABAP Platform do not properly verify incoming authentication assertions under certain configurations. An unauthenticated attacker can send crafted data to bypass login and act as any user, including privileged accounts.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems running SAP NetWeaver AS ABAP or ABAP Platform in the configurations the advisory describes. The sources do not name the specific configurations, so teams should confirm with SAP whether their setup is in scope.
Not affected if unknown
Who cares abap, netweaver, sap, self-hosted
Unknown from the sources.
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.