CVE-2026-23686: CRLF Injection vulnerability in SAP NetWeaver Application Server Java
Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23686?
CVE-2026-23686 is classified as a high severity vulnerability due to its potential for exploitation by authenticated attackers.
How do I fix CVE-2026-23686?
To remediate CVE-2026-23686, apply the latest security patches provided by SAP for the NetWeaver Application Server Java.
Who is affected by CVE-2026-23686?
CVE-2026-23686 affects organizations using the SAP NetWeaver Application Server Java that have administrative access.
What type of attack does CVE-2026-23686 facilitate?
CVE-2026-23686 allows for CRLF injection attacks, which can lead to content manipulation in the application.
Is CVE-2026-23686 a remote attack or requires local access?
CVE-2026-23686 requires authenticated administrative access, meaning it is not a remote attack vector.