PT-2026-39928 · Sap · Abap Platform+1

Published 2026-05-12 · Updated 2026-06-03 · CVE-2026-40135

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for ABAP and ABAP Platform (affected versions not specified)

Description An OS Command Injection issue allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server. This process bypasses the logging mechanism, enabling the execution of unintended OS commands without detection, which may impact the integrity and availability of the application.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-40135

Affected Products

Abap Platform

Netweaver Application Server For Java

References · 7

• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40135 · Security Note
• https://me.sap.com/notes/3730019 · Note
• https://t.me/CVEtracker/53455 · Telegram Post
• https://twitter.com/abokfelix/status/2054790844524196174 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2054110180711789002 · Twitter Post
• https://t.me/cveNotify/165837 · Telegram Post