CVE-2026-40135

6.5 Moyenne

Publiée le 12/05/2026 à 05:16 · Modifiée le 17/06/2026 à 12:44 · Analysée par le NVD · Source : cna@sap.com

Description

An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of unintended OS commands without detection, potentially impacting the integrity and availability of the application, with no impact on confidentiality.

Traduire en français

Produits concernés

SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform
Sap netweaver application server abap

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	cna@sap.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-77

Références

https://me.sap.com/notes/3730019 Permissions Required
https://url.sap/sapsecuritypatchday Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories