Login Request a demo
High severity · published Feb 10, 2026
CVE-2026-23687
XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized access to sensitive user data and potential disruption of normal system usage.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver AS ABAP and ABAP Platform · SAP_SE
SAP_BASIS 700; SAP_BASIS 701; SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; +13 more · source: vendor
SB
Sap Basis · Sap
700; 701; 702; 731; 740; 750; +12 more · source: NVD
Affected product
SN
SAP NetWeaver AS ABAP and ABAP Platform
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23687
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23687
Permissions Required
https://me.sap.com/notes/3697567
Vendor Advisory
https://url.sap/sapsecuritypatchday
seclists.org
http://seclists.org/fulldisclosure/2026/Jun/1
More from SAP NetWeaver AS ABAP and ABAP Platform
9.9
CVE-2026-44748
XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform
9.8
CVE-2026-27671
Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
8.8
CVE-2025-0063
SQL Injection vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
7.1
CVE-2026-44751
Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform
5.3
CVE-2025-42902
Memory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform