Improper authentication in SAP NetWeaver AS ABAP - CVE-2026-120017
Published: November 10, 2026
Vulnerability identifier: #VU164606
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-120017
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests within the SAML2 Service Provider. A remote attacker can bypass authentication process and gain unauthorized access to the application.
Successful exploitation of the vulnerability may lead to system compromise.
Affected software
SAP NetWeaver AS ABAP
How to mitigate CVE-2026-120017
Install updates from vendor's website.