PT-2026-39923 · Sap · Sap Netweaver+2

Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-40129

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Application Server ABAP for SAP NetWeaver and ABAP Platform (affected versions not specified)

Description A code injection flaw allows an authenticated attacker to send specially crafted inputs to the application. When processed, this input can be delivered to users subscribed to the channel, enabling the execution of arbitrary code for those users. This issue results in a low impact on system integrity, with no impact on confidentiality or availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-40129

Affected Products

Abap Platform

Abap Application Server

Sap Netweaver

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-40129 · Security Note
• https://me.sap.com/notes/3735359 · Note
• https://twitter.com/VulmonFeeds/status/2054112740487102568 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://t.me/CVEtracker/53450 · Telegram Post