Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-120017 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | SAP |
| Product | NetWeaver Application Server ABAP |
| Vulnerability Type | authentication bypass (insufficient assertion verification) (CWE-347) |
| SAP Note | 3849308 |
| CVSS Score | 10.0 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD, SAP
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts. Successful exploitation could cause a full system compromise, with the impact potentially extending to connected components and systems beyond the affected system. This results in a high impact on confidentiality, integrity, and availability of the application.
The flaw was published as part of the November 2026 SAP Security Patch Day. The attack requires no authentication.
Required Actions
- Apply the fix from SAP Note 3849308 (SAP Security Patch Day, November 2026) as a priority, since the flaw requires no authentication.
- Check in the note which authentication configurations are affected and whether they are present in your systems.
- Review the SAP Security Audit Log for unusual logons to privileged and technical accounts, especially from unknown addresses.
- Restrict network access to the HTTP(S) services of ABAP systems from the internet and from broad internal network segments.
Who Is Affected?
This vulnerability affects SAP NetWeaver Application Server ABAP. NVD provides no CPE configuration; affected versions and support packages are listed in SAP Note 3849308 (requires an SAP for Me account). SAP systems are mainly used by mid-sized and large enterprises (ERP, S/4HANA, NetWeaver platforms), so also check systems operated by partners and service providers.
The same Patch Day covered eight other critical SAP flaws: CVE-2026-109795, CVE-2026-109798, CVE-2026-109803, CVE-2026-76964, CVE-2026-76965, CVE-2026-89103, CVE-2026-89119, CVE-2026-89126.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-120017 vulnerability?
CVE-2026-120017 is a vulnerability in SAP NetWeaver Application Server ABAP — authentication bypass (insufficient assertion verification) — rated CVSS 10 (critical severity). SAP released a fix in Note 3849308 as part of the November 2026 SAP Security Patch Day.
Does exploiting CVE-2026-120017 require authentication?
According to the vendor's CVSS assessment, the attack requires no authentication. The attack is carried out over the network.
How to protect against CVE-2026-120017?
Apply the fix from SAP Note 3849308 and, until it is deployed, restrict network access to the affected component. The note lists affected versions and any available workarounds.
Who is affected by CVE-2026-120017?
It affects organizations running SAP NetWeaver Application Server ABAP, typically mid-sized and large enterprises with SAP ERP or S/4HANA and the related NetWeaver components.
