PT-2026-7213 · Sap · Sap Netweaver Application Server Java

Published 2026-02-10 · Updated 2026-02-10 · CVE-2026-23686

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java (affected versions not specified)

Description A CRLF Injection issue exists in SAP NetWeaver Application Server Java. An attacker with administrative privileges can send crafted content to the application. Processing this content allows the injection of untrusted entries into generated configuration, potentially altering application settings. Successful exploitation results in a limited impact on data integrity, with no effect on confidentiality or availability. The issue requires administrative access for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-113

CWE-436

Related Identifiers

CVE-2026-23686

Affected Products

Sap Netweaver Application Server Java

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-23686 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23686 · Vendor Advisory
• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://me.sap.com/notes/3673213 · Note
• https://twitter.com/VulmonFeeds/status/2021242436773704078 · Twitter Post