Vulnerability · Published Feb 10, 2026 · Assigned by sap

CVE-2026-23686CRLF Injection vulnerability in SAP NetWeaver Application Server Java

Low 3.4

In plain English

A low-severity security flaw in SAP NetWeaver Application Server Java from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)3.4Low

Exploit odds (30 days)0.2%top 90.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP NetWeaver Application Server Java	LMNWABASICAPPS 7.50

Weakness: CWE-113 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

In plain English

Official description

Affected products (as reported)

References