CVE-2026-23687

Published: Feb 10, 2026Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: CNA (Secondary)

Description

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized access to sensitive user data and potential disruption of normal system usage.

Affected (18)

Products: Sap: Sap Basis

Sap

1 product

Sap Basis

Configuration A

18 vulnerable

Vulnerable Software	Affected Versions
Sap Sap Basis	Version 700
Sap Sap Basis	Version 701
Sap Sap Basis	Version 702
Sap Sap Basis	Version 731
Sap Sap Basis	Version 740
Sap Sap Basis	Version 750
Sap Sap Basis	Version 751
Sap Sap Basis	Version 752
Sap Sap Basis	Version 753
Sap Sap Basis	Version 754
Sap Sap Basis	Version 755
Sap Sap Basis	Version 756
Sap Sap Basis	Version 757
Sap Sap Basis	Version 758
Sap Sap Basis	Version 804
Sap Sap Basis	Version 916
Sap Sap Basis	Version 917
Sap Sap Basis	Version 918

Related CWEs

CWE-347

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (3)

https://me.sap.com/notes/3697567

Source: cna@sap.com

Permissions Required

https://url.sap/sapsecuritypatchday

Source: cna@sap.com

Vendor Advisory

http://seclists.org/fulldisclosure/2026/Jun/1

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.