CVE-2026-120008
Last modified
CVE-2026-120008 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request to trigger an out-of-bounds memory write in a worker process.
Description
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request to trigger an out-of-bounds memory write in a worker process. Successful exploitation could result in memory corruption or repeated termination of the affected process, resulting in a high impact on availability and a low impact on integrity with no impact on confidentiality.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP NetWeaver (Internet Graphics Service) | BC-FES-IGS 7.20EXT; 7.20_EX2; 7.53; 7.54; 7.81; 9.16 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-120008?
How severe is CVE-2026-120008?
How do I fix CVE-2026-120008?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11998A flaw in AngularJS' Strict Contextual Escaping (SCE) logic …7.6
- CVE-2026-119980The UsersWP – Front-end login form, User Registration, User …6.5
- CVE-2026-11999X.509 trust-chain bypass (path-depth exhaustion) in the Open…7.5
- CVE-2026-1200A flaw was found in the rgaufman/live555 fork of live555. A …6.3
- CVE-2026-12000The Page and Post Restriction plugin for WordPress is vulner…7.5
- CVE-2026-120007NodeBB 1.18.0 through 4.16.5 contains an authorization bypas…6.5
- CVE-2026-120009SAP ABAP Developer Tools (AMDP Data Preview) does not perfor…7.2
- CVE-2026-12001A hardcoded credential vulnerability exists in the firmware …5.2
- CVE-2026-120010SAP NetWeaver Application Server (SAP Message Server) does n…7.5
- CVE-2026-120014SAP HANA XSA Web Dispatcher does not perform sufficient requ…7.6
- CVE-2026-120015SAP Host Agent does not sufficiently validate certain inputs…7.5
- CVE-2026-120016SAP NetWeaver Visual Composer does not perform sufficient in…6.1
Are you affected by CVE-2026-120008?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST