Veille CVE

Recherche « SAP_SE SAP NetWeaver and ABAP Platform »

11 CVE

Critique 3 Élevée 2 Moyenne 6 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « SAP_SE SAP NetWeaver and ABAP Platform » ✕
  1. CVE-2026-76963 4.3 Moyenne

    SAP_SE SAP NetWeaver and ABAP Platform

    Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected.

  2. CVE-2026-66767 7.7 Élevée

    SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform

    SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the application.

  3. CVE-2026-58241 4.2 Moyenne

    SAP_SE SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard

    SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tables that control access to data objects during specific operations. These unauthorized modifications could result in processing delays and operational disruption, leading to a low impact on the integrity and availability of the application with no impact on confidentiality.

  4. CVE-2026-58236 5.5 Moyenne

    SAP_SE SAP NetWeaver Application Server ABAP and ABAP Platform

    SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.

  5. CVE-2026-34265 9.8 Critique

    SAP_SE SAP NetWeaver and ABAP Platform

    SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.

  6. CVE-2026-58246 4.3 Moyenne

    SAP_SE SAP NetWeaver Application Server for ABAP

    SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.

  7. CVE-2026-44751 7.1 Élevée

    SAP_SE SAP NetWeaver AS ABAP and ABAP Platform

    Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report generation command which could overwrite information belonging to another user, resulting in escalation of privileges. This has high impact on integrity with low impact on availability and no impact on confidentiality of the application.

  8. CVE-2026-44748 9.9 Critique

    SAP_SE SAP NetWeaver AS ABAP and ABAP Platform

    SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information leading to unauthorized access to sensitive user data and potential disruption of normal system usage. This causes a high impact on confidentiality, integrity and availability of the application.

  9. CVE-2026-27671 9.8 Critique

    SAP_SE SAP NetWeaver AS ABAP and ABAP Platform

    Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on the confidentiality, integrity, and availability of the application.

  10. CVE-2026-40135 6.5 Moyenne

    SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform · Sap netweaver application server abap

    An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of unintended OS commands without detection, potentially impacting the integrity and availability of the application, with no impact on confidentiality.

  11. CVE-2026-40129 4.3 Moyenne

    SAP_SE SAP Application Server ABAP for SAP NetWeaver and ABAP Platform

    Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, an authenticated attacker could send specially crafted inputs to the application. If processed by the application, this input could be delivered to users subscribed to the channel and result in execution. Successful exploitation could enable the attacker to execute arbitrary code for other users, resulting in a low impact on the integrity, with no impact to the confidentiality and availability of the system.