{"id":"EUVD-2026-120700","enisaUuid":"ebb800f7-ee16-3a0c-b3bd-ee82f4fcbc96","description":"SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.","datePublished":"Nov 10, 2026, 12:43:09 AM","dateUpdated":"Nov 10, 2026, 12:43:09 AM","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://me.sap.com/notes/3849308\nhttps://url.sap/sapsecuritypatchday\n","aliases":"CVE-2026-120017\nGHSA-7x9g-g222-fmqj\n","assigner":"sap","epss":0.0,"enisaIdProduct":[{"id":"26ebbaf0-c5d6-354d-bef6-b5021573efe4","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 755"},{"id":"3592c2bd-4ba4-3961-9713-4e750c5ef219","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 920"},{"id":"58108d64-1335-3822-a497-3606d974468b","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 758"},{"id":"593c1d3e-66cf-3bab-972d-9951049b16ea","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 816"},{"id":"6246f8a5-4a21-3c29-8681-c2e6b83ae44d","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 757"},{"id":"72de7911-2463-3bde-ab36-e2f92ee9dcac","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 750"},{"id":"8524386b-4835-3f23-a3f2-dbc780d18ae6","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 754"},{"id":"96c8a070-34ee-3be0-87da-189f90eb550f","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 753"},{"id":"99c9370d-d567-3352-af8c-a5ddafc247cc","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 702"},{"id":"a23b3658-9e14-3222-807e-f8c6ee3bf9b6","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 752"},{"id":"bce93928-1b98-304e-b7a0-b7f25e444721","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 731"},{"id":"be061bc7-2b6d-3382-839c-b91a52a5aa5d","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 922"},{"id":"c2d5a05c-9001-3f3c-b703-fdf42a707e9c","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 921"},{"id":"d97f6994-b1f6-3597-8ec4-c532d767d347","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 751"},{"id":"eca4c63c-6557-359c-aa5b-90015fc35a0d","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 756"},{"id":"f52cb4ff-708f-3696-ac06-4d89dbd8442c","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 740"}],"enisaIdVendor":[{"id":"c9453909-a7e8-3cdc-8fbc-7668797db16d","vendor":{"name":"SAP_SE"}}],"enisaIdVulnerability":[{"id":"5f15140c-859e-38b9-920f-37e1ba5cbcc4","vulnerability":{"id":"CVE-2026-120017","description":"SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.","datePublished":"Nov 10, 2026, 12:43:09 AM","dateUpdated":"Nov 10, 2026, 12:43:09 AM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","references":"https://me.sap.com/notes/3849308\nhttps://url.sap/sapsecuritypatchday\n","enisa_id":"EUVD-2026-120700\n","assigner":"sap","epss":0.0,"dataProcessed":"Nov 10, 2026, 8:00:09 AM","vulnerabilityProduct":[{"id":"0925e191-575d-3a61-bf3b-359299f5091a","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 753"},{"id":"12e2cb68-fd8b-3634-b622-ada5b42d7f28","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 740"},{"id":"170bfba3-4b45-3cbe-bf90-5f8a6af0599d","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 816"},{"id":"272f73bc-413e-3e25-b015-ee6277b8162e","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 751"},{"id":"482ffc3b-b884-3025-aae8-072eb5d3576d","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 752"},{"id":"55c99e3f-9eee-3a63-8e42-4d8538e1805f","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 921"},{"id":"588547aa-8031-327a-8290-07addeb5448e","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 757"},{"id":"5ff69057-bde9-39fa-ac08-177184666c6c","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 750"},{"id":"6dc969ee-0e2e-3abe-a291-7ebdda41f962","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 702"},{"id":"7b6e4c75-d5cb-3ad2-a095-0ef2d096f9cb","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 922"},{"id":"7bc94c21-472e-3537-b4d6-c8b471124f4a","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 755"},{"id":"8542d546-d7e4-3cb8-96d1-dafa6d6149c1","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 754"},{"id":"a7430b6a-b25c-3228-a978-e597066248a9","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 920"},{"id":"b883765c-2ecf-36b9-833e-5fa19efefbcd","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 756"},{"id":"ced1e3cb-3963-3276-9405-3675277c2dc7","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 731"},{"id":"f5b23702-2813-3c13-bf99-5a4b7cd9df88","product":{"name":"SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)","vendor":{"name":"SAP_SE"}},"product_version":"SAP_BASIS 758"}],"vulnerabilityVendor":[{"id":"e050464d-75ce-35c6-9b65-c9ec45d3b260","vendor":{"name":"SAP_SE"}}]}},{"id":"be46f08f-20e7-3806-b1fa-1adb8b7528fd","vulnerability":{"id":"GHSA-7x9g-g222-fmqj","description":"SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.","datePublished":"Nov 10, 2026, 3:30:30 AM","dateUpdated":"Nov 10, 2026, 3:30:31 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-120017\nhttps://me.sap.com/notes/3849308\nhttps://url.sap/sapsecuritypatchday\n","enisa_id":"EUVD-2026-120700\n","aliases":"CVE-2026-120017\nGHSA-7x9g-g222-fmqj\n","epss":0.0,"dataProcessed":"Nov 10, 2026, 8:01:41 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}