Veille CVE

Recherche « SAP_SE SAP NetWeaver Application Server for ABAP »

10 CVE

Critique 3 Élevée 2 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « SAP_SE SAP NetWeaver Application Server for ABAP » ✕
  1. CVE-2026-76976 5.4 Moyenne

    SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

    Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.

  2. CVE-2026-76963 4.3 Moyenne

    SAP_SE SAP NetWeaver and ABAP Platform

    Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected.

  3. CVE-2026-66767 7.7 Élevée

    SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform

    SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the application.

  4. CVE-2026-58236 5.5 Moyenne

    SAP_SE SAP NetWeaver Application Server ABAP and ABAP Platform

    SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.

  5. CVE-2026-34265 9.8 Critique

    SAP_SE SAP NetWeaver and ABAP Platform

    SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.

  6. CVE-2026-58246 4.3 Moyenne

    SAP_SE SAP NetWeaver Application Server for ABAP

    SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.

  7. CVE-2026-44760 4.7 Moyenne

    SAP_SE SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)

    Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions. Successful exploitation could allow the attacker to steal session information, perform authenticated actions on behalf of the victim user etc. This vulnerability has low impact on confidentiality and integrity of the data and no impact on application 's availability.

  8. CVE-2026-44751 7.1 Élevée

    SAP_SE SAP NetWeaver AS ABAP and ABAP Platform

    Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report generation command which could overwrite information belonging to another user, resulting in escalation of privileges. This has high impact on integrity with low impact on availability and no impact on confidentiality of the application.

  9. CVE-2026-44748 9.9 Critique

    SAP_SE SAP NetWeaver AS ABAP and ABAP Platform

    SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information leading to unauthorized access to sensitive user data and potential disruption of normal system usage. This causes a high impact on confidentiality, integrity and availability of the application.

  10. CVE-2026-27671 9.8 Critique

    SAP_SE SAP NetWeaver AS ABAP and ABAP Platform

    Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on the confidentiality, integrity, and availability of the application.