CVE-2026-120017

Summary

A critical authentication bypass vulnerability (CWE-347) in SAP NetWeaver AS ABAP and ABAP Platform allows unauthenticated attackers to forge authentication assertions due to insufficient validation, enabling full user impersonation including privileged accounts. This leads to complete compromise of confidentiality, integrity, and availability.

Exploitability

Exploitation requires no prior access or user interaction and is straightforward for an attacker with network access to the vulnerable service, provided they can craft validly structured but forged authentication assertions.

Blast radius

Successful exploitation enables full system compromise and may propagate lateral movement to connected systems, potentially affecting entire enterprise landscapes integrated with the affected SAP environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply SAP Security Note 3214567 (released April 2026) or upgrade to SAP NetWeaver AS ABAP 7.56 SP06 or ABAP Platform 2.00 SP06, as explicitly recommended by SAP in their advisory for CVE-2026-120017.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.