Description
Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected.
Published: 2026-09-08
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A missing authorization check in SAP NetWeaver and ABAP Platform allows an authenticated attacker to gain unauthorized access to sensitive system configuration information. This breach could expose security‑relevant settings and internal details, presenting a low confidentiality impact while integrity and availability remain unchanged.

Affected Systems

The vulnerability impacts SAP NetWeaver and the ABAP Platform, with no specific version information provided. All installations of these products that have not applied the relevant SAP update are susceptible.

Risk and Exploitability

The CVSS score of 4.3 indicates a medium overall severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication, and no publicly documented exploits exist. Consequently, the risk is moderate, underscoring the importance of validating that proper authorization controls are enforced.

Generated by OpenCVE AI on September 8, 2026 at 01:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Consult SAP support for applicable SAP Notes and apply any released patches that address the missing authorization check
  • Limit access to configuration interfaces so that only authorized privileged users can view or modify settings
  • Review and audit system logs to detect any unauthorized attempts to access configuration information

Generated by OpenCVE AI on September 8, 2026 at 01:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Sap Se
Sap Se sap Netweaver And Abap Platform
Vendors & Products Sap Se
Sap Se sap Netweaver And Abap Platform

Tue, 08 Sep 2026 00:45:00 +0000

Type Values Removed Values Added
Description Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected.
Title Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Sap Se Sap Netweaver And Abap Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2026-09-08T00:12:21.196Z

Reserved: 2026-08-20T05:15:36.823Z

Link: CVE-2026-76963

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-08T01:17:55.040

Modified: 2026-09-08T01:17:55.040

Link: CVE-2026-76963

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T01:30:06Z

Weaknesses