An authenticated attacker with administrative privileges can craft content that exploits a CRLF injection flaw in SAP NetWeaver Application Server Java. When this content is processed, the application injects untrusted entries into generated configuration files, allowing manipulation of application-controlled settings. The resulting loss of integrity is limited to configuration data; confidentiality and availability are not affected. This weakness aligns with CWE‑113 and CWE‑436.

SAP NetWeaver Application Server Java version 7.50 is affected. No other versions are listed in the CNA data.

The CVSS score of 3.4 indicates a low severity rating, while the EPSS score of less than 1% reflects an extremely low likelihood of exploitation. The vulnerability is not cataloged in the CISA KEV list. Exploitation requires authenticated administrative access and does not pose a remote threat. Given that privileged accounts can be more frequently targeted, organizations should consider immediate remediation to prevent potential configuration abuse.