The User Management Engine in SAP NetWeaver Application Server for Java uses an outdated cryptographic algorithm to encrypt user mapping data, a weakness classified as improper encryption strength. This flaw can permit an attacker with elevated privileges, preferably those with local or otherwise high-level access, to partially reveal encrypted data. Consequently, confidentiality is at risk, while integrity and availability remain unaffected.

This vulnerability affects the SAP NetWeaver Application Server for Java (NW AS Java) component known as User Mapping (UME). All versions of this product that rely on the specified old encryption algorithm are impacted; specific version information is not provided in the advisory.

The CVSS score of 3 indicates low severity, and the EPSS score of less than one percent suggests a very low probability of exploitation in the wild. The weakness is not listed in the CISA KEV catalog. Exploitation requires high-privileged access, making the attack vector likely internal or through compromised administrative accounts, rather than remote.