Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-0510: Sensitive User Data at Risk: Obsolete Encryption in NW AS Java

CVE-2026-0510 · published 9 months ago

Summary

The encryption used by SAP's NetWeaver Application Server for Java to protect user data is outdated and can be broken by a highly privileged attacker. This could lead to the disclosure of sensitive information. Users should ensure they are using the latest version of the software and consider updating their encryption methods to prevent this risk.

Original advisory text

The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping data. This weakness could allow an attacker with high-privileged access to exploit the vulnerability under specific conditions potentially leading to partial disclosure of sensitive information.This has low impact on confidentiality with no impact on integrity and availability of the application.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.0 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-326Inadequate Encryption Strength

Timeline

Published13 Jan 2026

Updated26 Oct 2026

First seen7 Mar 2026

Sources

CVE-2026-0510 · NVD

Track software like this

Free during beta