← Back

CVE-2026-40135

nvd nist
Published: May 12, 2026Modified: Jun 3, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Exploitability: 1.2 / Impact: 5.2
Source: CNA

Description

An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of unintended OS commands without detection, potentially impacting the integrity and availability of the application, with no impact on confidentiality.

Affected (15)

Sap
1 product
Netweaver Application Server Abap
Configuration A
15 vulnerable
Vulnerable SoftwareAffected Versions
Sap
Netweaver Application Server Abap
Version 700
Netweaver Application Server Abap
Version 701
Netweaver Application Server Abap
Version 702
Netweaver Application Server Abap
Version 731
Netweaver Application Server Abap
Version 740
Netweaver Application Server Abap
Version 750
Netweaver Application Server Abap
Version 751
Netweaver Application Server Abap
Version 752
Netweaver Application Server Abap
Version 753
Netweaver Application Server Abap
Version 754
Netweaver Application Server Abap
Version 755
Netweaver Application Server Abap
Version 756
Netweaver Application Server Abap
Version 757
Netweaver Application Server Abap
Version 758
Netweaver Application Server Abap
Version 816

Related CWEs

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (2)

Source: cna@sap.com
Permissions Required
Source: cna@sap.com
Vendor Advisory

Timeline

No history available yet.