Vulnerability · Published Feb 10, 2026 · Assigned by sap

CVE-2026-23689Denial of service (DOS) in SAP Supply Chain Management

High 7.7

In plain English

A high-severity security flaw in SAP Supply Chain Management from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.4%top 63.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP Supply Chain Management	SCMAPO 713714SCM 700701702712

Weakness: CWE-606 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

In plain English

Official description

Affected products (as reported)

References