CVE-2023-26459

highpriority · track · 30EPSS 0.004 · 31 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.37% (31st) EPSS

CVSS 7.4 · high

Is it mine?

29 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · scored 2026-10-27

Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, an attacker authenticated as a non-administrative user can craft a request which will trigger the application server to send a request to an arbitrary URL which can reveal, modify or make unavailable non-sensitive information, leading to low impact on Confidentiality, Integrity and Availability.

cvss

Technical severity, 0–10. One row per scoring source.

7.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.4

v3.17.4highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:Lprimary · NVD / NIST USexploitability 3.1 · impact 3.7

v3.17.4highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:Lsecondary · ENISA EU

v3.17.4highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:Lsecondary · cna@sap.comexploitability 3.1 · impact 3.7

v3.16.8mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-918US

affected products (29)

Products and version ranges known to be affected.

SAP Softwareall versionscert_bundDEcpe:/a:sap:sap:-
SAP NetWeaver AS for ABAP and ABAP Platform≤ 750enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 754enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 731enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 701enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 757enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 756enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 755enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 752enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 702enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 700enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 740enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 753enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 791enisa_euvdEU
SAP NetWeaver AS for ABAP and ABAP Platform≤ 751enisa_euvdEU
sap netweaver application server abap= 700nvdUScpe:2.3:a:sap:netweaver_application_server_abap:*:*:*:*:*:*:*:*
sap netweaver application server abap= 701nvdUScpe:2.3:a:sap:netweaver_application_server_abap:*:*:*:*:*:*:*:*
sap netweaver application server abap= 702nvdUScpe:2.3:a:sap:netweaver_application_server_abap:*:*:*:*:*:*:*:*
sap netweaver application server abap= 731nvdUScpe:2.3:a:sap:netweaver_application_server_abap:*:*:*:*:*:*:*:*
sap netweaver application server abap= 740nvdUScpe:2.3:a:sap:netweaver_application_server_abap:*:*:*:*:*:*:*:*

showing 20 of 29

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-0635SAP Patchday März 2023Deutsch2023-03-13csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren und einen Cross-Site-Scripting-Angriff durchzuführen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund nvd NVD CVE.org MITRE

published 2023-03-14modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan