PT-2026-7213 · Sap · Sap Netweaver Application Server Java

CVE-2026-23686 · Publicado 2026-02-10 · Atualizado 2026-02-10

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java (affected versions not specified)

Description A CRLF Injection issue exists in SAP NetWeaver Application Server Java. An attacker with administrative privileges can send crafted content to the application. Processing this content allows the injection of untrusted entries into generated configuration, potentially altering application settings. Successful exploitation results in a limited impact on data integrity, with no effect on confidentiality or availability. The issue requires administrative access for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-113

CWE-436

Identificadores relacionados

CVE-2026-23686

Produtos afetados

Sap Netweaver Application Server Java

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-23686 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-23686 · Aviso do Fabricante
• https://me.sap.com/notes/3673213 · Nota
• https://twitter.com/VulmonFeeds/status/2021242436773704078 · Publicação no Twitter
• https://url.sap/sapsecuritypatchday · Aviso do Fabricante