Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-120017: SAP NetWeaver ABAP SAML2 allows attackers to impersonate users
CVE-2026-120017 · published today
Summary
The SAP NetWeaver AS ABAP and ABAP Platform can be tricked into accepting fake login messages when it is set up in certain ways. This lets an unauthenticated person log in as any user, even administrators, potentially taking full control of the system and any connected applications. Apply the vendor's security update or re‑configure the SAML2 settings to require proper verification of authentication messages.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sap_se | sap netweaver as abap and abap platform (saml2 service provider) | SAP_BASIS 702 |
Original advisory text
Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published10 Nov 2026
Updated10 Nov 2026
First seen10 Nov 2026
Track software like this
Free during beta