CVE-2026-120017

CVE Enrichment

CVSS: 10.0 CRITICAL
CISA KEV: Not listed

Description

SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 10-Nov-2026 08:17
Last Modified: 10-Nov-2026 08:17
CWE: CWE-347

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

SAP_SE · SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) Source: CNA · [email protected]
Default status: unaffected

SAP_BASIS 702 — affected
SAP_BASIS 731 — affected
SAP_BASIS 740 — affected
SAP_BASIS 750 — affected
SAP_BASIS 751 — affected
SAP_BASIS 752 — affected
SAP_BASIS 753 — affected
SAP_BASIS 754 — affected
SAP_BASIS 755 — affected
SAP_BASIS 756 — affected
SAP_BASIS 757 — affected
SAP_BASIS 758 — affected
SAP_BASIS 816 — affected
SAP_BASIS 920 — affected
SAP_BASIS 921 — affected
SAP_BASIS 922 — affected

References

Last enrichment sync: 10-Nov-2026 19:07
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

SAP also resolved a max-severity missing authentication bug in NetWeaver (CVE-2026-120017) that, in certain configurations, could allow unauthenticated attackers to submit specially crafted data and impersonate SAP Patches Critical ICM2SHELL and ProxyGate Vulnerabilities
On the affected SAML setups, an attacker could use CVE-2026-120017 to log in as privileged users too, according to the vendor. A full compromise could follow, possibly reaching connected systems. SAP Fixes Four Maximum-Severity Flaws, Including Two That Could Enable Remote Code Execution
The company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components. SAP Fixes Four Maximum-Severity Flaws in November Security Update

CVE (7)

MITRE ATT&CK (1)

Vendors (1)

Products (10)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.