critical · CVSS v3 10

CVE-2026-120017

SAP NetWeaver AS ABAP and ABAP Platform allow unauthenticated authentication bypass, enabling attackers to impersonate any user, including p

Overview

SAP NetWeaver AS ABAP and ABAP Platform allow unauthenticated authentication bypass, enabling attackers to impersonate any user, including privileged accounts. This can lead to full system compromise and affect connected components.

Description

SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.

Impact

Confidentiality, integrity, and availability are compromised. Defenders must protect against unauthorized access and potential lateral movement. The risk extends to any connected systems that rely on the compromised SAP instance.

Remediation

Apply the latest SAP security patch for NetWeaver AS ABAP (SAP note 3071234). Disable or restrict the authentication assertion feature if not required. Ensure that only trusted identity providers are configured and enforce strict assertion validation. Monitor logs for anomalous authentication attempts.

Risk context

Severity is critical with a CVSS v3 score of 10.0. No EPSS data available, but the vulnerability can be exploited remotely without authentication, making it highly urgent for organizations running SAP NetWeaver AS ABAP.

Affected products

  • SAP NetWeaver AS ABAP
  • SAP ABAP Platform
  • SAP NetWeaver
  • SAP Application Server ABAP

Scores

Severity
critical
CVSS v2
10
CVSS v3
10
CVSS v4
—
EPSS
—

SAP NetWeaver Authentication Bypass Privilege Escalation Critical Remote Exploit System Compromise

← All CVEs

Related CVEs

critical

CVE-2026-125358

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.

View analysis

critical

CVE-2026-125370

Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrary role, userGroups and permissions claims, which JwtStrategy.validate() trusts without a database lookup, to take control of pipelines, applications, users and API tokens.

View analysis

critical

CVE-2026-125383

INDOTALENT WHMS before 10.20261109 has an authentication bypass due to hard‑coded JWT signing key, issuer, and audience. Unauthenticated attackers can forge tokens and impersonate any user, including administrators. This flaw allows full control over the API.

View analysis

critical

CVE-2026-125384

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.

View analysis