---
id: "CVE-2026-120017"
page: "https://infrastack.ai/live/CVE-2026-120017"
kind: "vulnerability"
aliases: ["CVE-2026-120017"]
title: "SAP NetWeaver ABAP: weak authentication checks let attackers impersonate any user"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["abap", "netweaver", "runtime", "sap", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-11-10T01:17:16+00:00"
first_seen_at: "2026-11-10T01:26:40+00:00"
updated_at: "2026-11-10T01:31:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120017", "first_seen_at": "2026-11-10T01:26:40+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T01:31:32+00:00"}]
exploit_sources: []
---

# SAP NetWeaver ABAP: weak authentication checks let attackers impersonate any user

Link for people: https://infrastack.ai/live/CVE-2026-120017 (this .md is for agents)

SAP NetWeaver AS ABAP and ABAP Platform do not properly verify incoming authentication assertions under certain configurations. An unauthenticated attacker can send crafted data to bypass login and act as any user, including privileged accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

unknown: no SAP security note found yet for this CVE id. Check SAP for Me security notes and the SAP Security Patch Day page for the note number.

## Timeline

- 2026-11-10T01:26:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120017
- 2026-11-10T01:31:32+00:00 analyst — No primary source found: NVD page returned empty via web-cli, id absent from SAP patch day pages Jun-Oct 2026 and Nov 2026 page not fetchable; searches only return unrelated CVEs. Versions/fix unknown; settle by reading SAP for Me note or the Nov 10 2026 patch day page. Possibly related but unconfirmed: CVE-2026-44748 (SAML XML signature wrapping, note 3746332, SAP_BASIS 702-919), do not treat as same.

## From the sources

SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_