CVE-2026-23686

LowCVSS 3.4/10Last modified Jun 17, 2026

Description

Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.

Metrics

CVSS 3.1 3.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-113 CWE-436

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver Application Server Java	LMNWABASICAPPS 7.50

References

https://me.sap.com/notes/3673213Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-236878.8SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed mes CVE-2026-236884.3SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation CVE-2026-236897.7Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and ne CVE-2026-23699.1A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buf CVE-2026-2369310.0ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (elementskit-lite) WordPress plugin versions prior to 3.7.9 CVE-2026-236945.1Aruba HiSpeed Cache (aruba-hispeed-cache) WordPress plugin versions prior to 3.0.5 contain a cross-site request forgery (CSRF) vulnerability CVE-2026-236955.4Cockpit CMS through version 2.14.0, patched in commit 72a83fc, contains a stored cross-site scripting vulnerability in the Set field type's CVE-2026-236969.9Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality CVE-2026-236978.8Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code executio CVE-2026-236987.2Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows admini CVE-2026-236998.6AP180 series with firmware versions prior to AP_RGOS 11.9(4)B1P8 contains an OS command injection vulnerability. If this vulnerability is ex CVE-2026-23708.8GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1