CVE-2026-120017
Last modified
CVE-2026-120017 is a critical-severity vulnerability rated 10/10 on the CVSS scale. SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts.
Description
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) | SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; SAP_BASIS 751; SAP_BASIS 752; SAP_BASIS 753; SAP_BASIS 754; SAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; SAP_BASIS 758; SAP_BASIS 816; SAP_BASIS 920; SAP_BASIS 921; SAP_BASIS 922 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-120017?
How severe is CVE-2026-120017?
How do I fix CVE-2026-120017?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-120009SAP ABAP Developer Tools (AMDP Data Preview) does not perfor…7.2
- CVE-2026-12001A hardcoded credential vulnerability exists in the firmware …5.2
- CVE-2026-120010SAP NetWeaver Application Server (SAP Message Server) does n…7.5
- CVE-2026-120014SAP HANA XSA Web Dispatcher does not perform sufficient requ…7.6
- CVE-2026-120015SAP Host Agent does not sufficiently validate certain inputs…7.5
- CVE-2026-120016SAP NetWeaver Visual Composer does not perform sufficient in…6.1
- CVE-2026-120019The W3 Total Cache plugin for WordPress is vulnerable to Sto…5.4
- CVE-2026-12002The Smash Balloon Social Photo Feed – Easy Social Feeds Plug…4.7
- CVE-2026-12003To allow builds of Python to be run from an in-tree layout (…5.3
- CVE-2026-120035The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, N…5.4
- CVE-2026-12004IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…8.7
- CVE-2026-120040The Mail logging & Catcher plugin for WordPress is vulnerabl…7.5
Are you affected by CVE-2026-120017?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST