CVE-2026-23686 — CRLF Injection vulnerability in SAP NetWeaver Application Server Java

CVE-2026-23686

CRLF Injection vulnerability in SAP NetWeaver Application Server Java PUBLISHED

Description (CNA)

Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP NetWeaver Application Server Java	affected LMNWABASICAPPS 7.50

CWE

CWE-113

References

https://me.sap.com/notes/3673213
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.