CVE-2026-23685

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23685", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-01-14T18:26:17.297Z", "datePublished": "2026-02-10T03:02:27.146Z", "dateUpdated": "2026-02-10T17:19:28.762Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP NetWeaver (JMS service)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "J2EE-FRMW 7.50"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during internal logic execution, potentially causing a denial of service. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.</p>"}], "value": "Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during internal logic execution, potentially causing a denial of service. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:02:27.146Z"}, "references": [{"url": "https://me.sap.com/notes/3687285"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Insecure Deserialization vulnerability in SAP NetWeaver (JMS service)", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T17:19:21.972678Z", "id": "CVE-2026-23685", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T17:19:28.762Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23685", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T17:19:21.972678Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T17:19:25.418Z"}}], "cna": {"title": "Insecure Deserialization vulnerability in SAP NetWeaver (JMS service)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP NetWeaver (JMS service)", "versions": [{"status": "affected", "version": "J2EE-FRMW 7.50"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3687285"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during internal logic execution, potentially causing a denial of service. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.", "supportingMedia": [{"type": "text/html", "value": "<p>Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during internal logic execution, potentially causing a denial of service. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:02:27.146Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23685", "state": "PUBLISHED", "dateUpdated": "2026-02-10T17:19:28.762Z", "dateReserved": "2026-01-14T18:26:17.297Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-02-10T03:02:27.146Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP NetWeaver (JMS service)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "J2EE-FRMW 7.50"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver:7.50:*:*:*:java_as:*:*:*", "matchCriteriaId": "DC79A74D-A118-4B1D-B1D0-C8CD8DA72244", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during internal logic execution, potentially causing a denial of service. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected."}, {"lang": "es", "value": "Debido a una vulnerabilidad de deserializaci\u00f3n en SAP NetWeaver (servicio JMS), un atacante autenticado como administrador con acceso local podr\u00eda enviar contenido especialmente dise\u00f1ado al servidor. Si es procesado por la aplicaci\u00f3n, este contenido podr\u00eda desencadenar un comportamiento no deseado durante la ejecuci\u00f3n de la l\u00f3gica interna, causando potencialmente una denegaci\u00f3n de servicio. La explotaci\u00f3n exitosa resulta en un alto impacto en la disponibilidad, mientras que la confidencialidad y la integridad permanecen inafectadas."}], "id": "CVE-2026-23685", "lastModified": "2026-06-17T10:21:57.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23685", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T17:19:21.972678Z", "version": "2.0.3"}}]}, "published": "2026-02-10T04:16:02.850", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3687285"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "J2EE-FRMW 7.50"}}], "product": "sap_netweaver_(jms_service)", "vendor": "sap_se"}], "analysis": {"en": {"generated_at": "2026-04-18T12:54:20.213758+00:00", "value": {"mitigation_remediation": ["Apply the security patch referenced in SAP Note 3687285 to correct the deserialization flaw.", "Limit the exposure of the JMS service to trusted networks and enforce strong authentication for local administrators.", "Implement monitoring for sudden message spikes or resource exhaustion on the JMS service to detect attempted exploitation."], "summary": {"action": "Apply Patch Locally", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "SAP NetWeaver 7.50 JMS service, administered by SAP SE. The vulnerability applies to any instance of this product running the JMS component.", "description_and_impact": "A deserialization flaw in the SAP NetWeaver JMS service allows an attacker who is an authenticated administrator with local access to submit maliciously crafted content. When processed by the application, this content can trigger unintended internal logic, causing a denial of service. The weakness is classified as CWE\u2011502 insecure deserialization and does not affect confidentiality or integrity.", "risk_and_exploitability": "The CVSS score is 4.4, indicating moderate severity, while the EPSS score is below 1% and the vulnerability is not listed in CISA\u2019s KEV catalog, implying a low probability of widespread exploitation. The attack requires local administrative access, so it is not remotely exploitable. An adversary who meets this prerequisite can execute a simple message injection that would disrupt service availability, potentially affecting all users of the affected system."}}}}, "created": "2026-02-10T11:34:41.095268+00:00", "updated": "2026-04-18T13:00:08.754931+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$sap_netweaver_(jms_service)"]}