CVE-2026-23685: Insecure Deserialization vulnerability in SAP NetWeaver (JMS service)
Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during internal logic execution, potentially causing a denial of service. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23685?
CVE-2026-23685 is considered a critical vulnerability due to the potential for unauthorized access and manipulation of the SAP NetWeaver system.
How do I fix CVE-2026-23685?
To fix CVE-2026-23685, apply the latest security patches and updates provided by SAP for the NetWeaver platform.
Who is affected by CVE-2026-23685?
CVE-2026-23685 affects installations of SAP NetWeaver with the JMS service enabled, specifically those where administrators have local access.
What type of vulnerability is CVE-2026-23685?
CVE-2026-23685 is an insecure deserialization vulnerability that can allow attackers to execute malicious payloads on the server.
What are the potential impacts of CVE-2026-23685?
The potential impacts of CVE-2026-23685 include unauthorized data manipulation, execution of arbitrary code, and compromise of sensitive information.