Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
- Published
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 32/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
SAP NetWeaver AS ABAP and ABAP Platform, in its SAML2 Service Provider component, fails to properly verify incoming authentication assertions under certain configurations. Remotely and without logging in, an attacker can submit crafted data to bypass authentication and impersonate any user, including privileged accounts, potentially leading to full compromise of the system and connected systems.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure17/25No login or user action needed per the CVSS vector, reachable over the network without a login · Unknown: No advisory context yet
- Reach?/20Unknown. No tracked technology or package matched
- Severity10/10CVSS 10.0
- No patch5/5No patch listed yet
What would change the score
- Would score about 77 if added to CISA KEV
- Would score about 72 if CISA's SSVC rates exploitation active
- Would score about 37 if advisories confirm default setups are exposed
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- SAP_SE SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 920, SAP_BASIS 921, SAP_BASIS 922
Evidence 2
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120017
Is CVE-2026-120017 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by CVE-2026-120017?
SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider): versions SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751 and 11 more.Source: cve.now feed data