{"id":"CVE-2026-120017","kind":"vulnerability","aliases":["CVE-2026-120017"],"related":[],"title":"SAP NetWeaver ABAP: weak authentication checks let attackers impersonate any user","description":"SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.","summary":"SAP NetWeaver AS ABAP and ABAP Platform do not properly verify incoming authentication assertions under certain configurations. An unauthenticated attacker can send crafted data to bypass login and act as any user, including privileged accounts.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["abap","netweaver","runtime","sap","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"unknown: no SAP security note found yet for this CVE id. Check SAP for Me security notes and the SAP Security Patch Day page for the note number.","fix":null,"status":"open","published_at":"2026-11-10T01:17:16+00:00","first_seen_at":"2026-11-10T01:26:40+00:00","triaged_at":"2026-11-10T01:28:10+00:00","updated_at":"2026-11-10T01:31:32+00:00","category":"runtime","confidence":0.2,"triage":{"at":"2026-11-10T01:28:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver ABAP: weak authentication checks let attackers impersonate any user","impact":"high","summary":"SAP NetWeaver AS ABAP and ABAP Platform do not properly verify incoming authentication assertions under certain configurations. An unauthenticated attacker can send crafted data to bypass login and act as any user, including privileged accounts.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sap","netweaver","abap","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker impersonates admins and takes full control of the system","analyst_note":"Find the SAP security note and affected configuration details for CVE-2026-120017; sources give no versions or fix.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Systems running SAP NetWeaver AS ABAP or ABAP Platform in the configurations the advisory describes. The sources do not name the specific configurations, so teams should confirm with SAP whether their setup is in scope.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000686,"input_tokens":4619,"output_tokens":448,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the SAP security note and affected configuration details for CVE-2026-120017; sources give no versions or fix.","search":"'-120017':14A,17A '-2026':13A,16A 'abap':3A,18B,28B,30B,63C,65C 'account':59B,96C 'act':53B 'affect':117C 'applic':132C 'arbitrari':92C 'assert':38B,75C 'attack':8A,44B,81C 'authent':5A,37B,74C,89C 'avail':129C 'beyond':115C 'bypass':50B,88C 'caus':100C 'certain':40B,77C 'check':6A 'compon':112C 'compromis':104C 'confidenti':126C 'configur':41B,78C 'connect':111C 'could':82C,99C 'craft':47B,85C 'cve':12A,15A 'data':48B,86C 'exploit':98C 'extend':109C 'full':102C 'high':123C 'host':24B 'impact':107C,124C 'imperson':9A,91C 'includ':57B,94C 'incom':36B,73C 'integr':127C 'let':7A 'login':51B 'netweav':2A,19B,26B,61C 'perform':69C 'platform':31B,66C 'potenti':108C 'privileg':58B,95C 'proper':34B 'result':120C 'runtim':20B 'sap':1A,21B,25B,60C 'self':23B 'self-host':22B 'send':46B 'special':84C 'submit':83C 'success':97C 'suffici':70C 'system':103C,114C,118C 'unauthent':43B,80C 'user':11A,56B,93C 'verif':71C 'verifi':35B 'weak':4A","nicknames":[],"mitigations":[],"who_affected":"Systems running SAP NetWeaver AS ABAP or ABAP Platform in the configurations the advisory describes. The sources do not name the specific configurations, so teams should confirm with SAP whether their setup is in scope.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["abap","critical","netweaver","runtime","sap","selfhosted"],"campaign_type":null,"search_a":"'-120017':14A,17A '-2026':13A,16A 'abap':3A 'attack':8A 'authent':5A 'check':6A 'cve':12A,15A 'imperson':9A 'let':7A 'netweav':2A 'sap':1A 'user':11A 'weak':4A","search_b":"'abap':18B,28B,30B 'account':59B 'act':53B 'assert':38B 'attack':44B 'authent':37B 'bypass':50B 'certain':40B 'configur':41B 'craft':47B 'data':48B 'host':24B 'includ':57B 'incom':36B 'login':51B 'netweav':19B,26B 'platform':31B 'privileg':58B 'proper':34B 'runtim':20B 'sap':21B,25B 'self':23B 'self-host':22B 'send':46B 'unauthent':43B 'user':56B 'verifi':35B","search_c":"'abap':63C,65C 'account':96C 'affect':117C 'applic':132C 'arbitrari':92C 'assert':75C 'attack':81C 'authent':74C,89C 'avail':129C 'beyond':115C 'bypass':88C 'caus':100C 'certain':77C 'compon':112C 'compromis':104C 'confidenti':126C 'configur':78C 'connect':111C 'could':82C,99C 'craft':85C 'data':86C 'exploit':98C 'extend':109C 'full':102C 'high':123C 'impact':107C,124C 'imperson':91C 'includ':94C 'incom':73C 'integr':127C 'netweav':61C 'perform':69C 'platform':66C 'potenti':108C 'privileg':95C 'result':120C 'sap':60C 'special':84C 'submit':83C 'success':97C 'suffici':70C 'system':103C,114C,118C 'unauthent':80C 'user':93C 'verif':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120017","severity":null,"published_at":"2026-11-10T01:17:16+00:00","modified_at":"2026-11-10T01:17:16+00:00","first_seen_at":"2026-11-10T01:26:40+00:00","fetched_at":"2026-11-10T01:26:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120017:2375","url":null,"severity":null,"published_at":"2026-11-10T01:31:32+00:00","modified_at":"2026-11-10T01:31:32+00:00","first_seen_at":"2026-11-10T01:31:32+00:00","fetched_at":"2026-11-10T01:31:32+00:00","note":"No primary source found: NVD page returned empty via web-cli, id absent from SAP patch day pages Jun-Oct 2026 and Nov 2026 page not fetchable; searches only return unrelated CVEs. Versions/fix unknown; settle by reading SAP for Me note or the Nov 10 2026 patch day page. Possibly related but unconfirmed: CVE-2026-44748 (SAML XML signature wrapping, note 3746332, SAP_BASIS 702-919), do not treat as same."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}