Under certain configurations, an unauthenticated attacker can bypass authentication in SAP NetWeaver AS ABAP and ABAP Platform and impersonate any user, including privileged accounts. The flaw carries a maximum CVSS 3.1 score of 10.0.
What Is It
CVE-2026-120017 is an authentication bypass in the SAML2 Service Provider of SAP NetWeaver AS ABAP and ABAP Platform. According to the NVD description, under certain configurations the platform does not properly check incoming authentication assertions. An unauthenticated attacker can send specially crafted data to bypass authentication and act as any user, including privileged ones.
SAP's CNA classifies the weakness as CWE-347 (Improper Verification of Cryptographic Signature). NVD lists the record with status "Received", so NVD has not yet completed its own analysis.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which means:
- Network-reachable, with low attack complexity
- No privileges and no user interaction needed
- Changed scope: the impact can extend beyond the vulnerable component
- High impact on confidentiality, integrity, and availability
SAP states that a successful attack could lead to full system compromise, and that the damage could reach connected components and systems beyond the affected one. SAP ABAP systems often hold core business data and integrate with many other systems, so the blast radius of one compromised instance can be large.
Exploitation status: The sources cited here do not confirm active exploitation, and they do not say whether CVE-2026-120017 is in the CISA Known Exploited Vulnerabilities (KEV) catalog.
What's Vulnerable
The affected product is SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider). These SAP_BASIS releases are listed as affected:
- SAP_BASIS 702, 731
- SAP_BASIS 740
- SAP_BASIS 750, 751, 752, 753, 754, 755, 756, 757, 758
- SAP_BASIS 816
- SAP_BASIS 920, 921, 922
The issue appears "under certain configurations." The description ties it to the SAML2 Service Provider, so systems that use SAML-based authentication should be checked first. The record does not list any CPE entries.
Patch Status
SAP has issued SAP Security Note 3849308 for this vulnerability, and it is referenced through SAP's Security Patch Day page. Administrators should:
- Review SAP Note 3849308 (requires an SAP for Me login) and apply the fix it describes to every affected SAP_BASIS release.
- Find SAP ABAP systems that have the SAML2 Service Provider enabled and patch those first.
Whether or not a KEV listing or federal due date applies, a CVSS 10.0 unauthenticated bypass warrants emergency patching.