CVE-2026-120017

Authentication bypass in SAP NetWeaver AS ABAP under some configs

CVSS 3.1: 10.0 critical
EPSS: —
Published: Nov 10, 2026 · 1d ago
Modified: Nov 10, 2026

Analyze CVE-2026-120017 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

SAP NetWeaver AS ABAP and ABAP Platform do not sufficiently verify incoming authentication assertions under certain configurations. An unauthenticated remote attacker can submit crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation can fully compromise the system, and impact may extend to connected components and systems.

What to do: Apply SAP's update for CVE-2026-120017. SAP has not listed affected or fixed versions.

Product	Affected
SAP NetWeaver AS ABAP	—
SAP ABAP Platform	—

Estimated exposure

No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.