NCSC | Security Advisories
Bekijk RSS-feed

Security Advisories

Download

Security Advisory; NCSC-2026-0485 [1.0.0]

Security Advisory
NCSC-2026-0485 [1.0.0]
Publicatie
12-11-2026 09:43 (Europe/Amsterdam)
Prioriteit
Normaal
Betreft
Kwetsbaarheden verholpen in SAP-producten

Kenmerken

  • External Control of System or Configuration Setting
  • Improper Limitation of a Pathname to a Restricted Directory
  • Improper Neutralization of Input During Web Page Generation
  • Improper Control of Generation of Code
  • Stack-based Buffer Overflow
  • Heap-based Buffer Overflow
  • Out-of-bounds Read
  • Incorrect Calculation of Buffer Size
  • Integer Overflow or Wraparound
  • Generation of Error Message Containing Sensitive Information
  • Plaintext Storage of a Password
  • Authentication Bypass by Capture-replay
  • Use of Weak Hash
  • Improper Verification of Cryptographic Signature
  • Cross-Site Request Forgery
  • Divide By Zero
  • Uncontrolled Search Path Element
  • Insufficiently Protected Credentials
  • Improper Restriction of XML External Entity Reference
  • Authorization Bypass Through User-Controlled Key
  • Exposed Dangerous Method or Function
  • Allocation of Resources Without Limits or Throttling
  • Out-of-bounds Write
  • Loop with Unreachable Exit Condition
  • Missing Authorization
  • Incorrect Authorization
  • Use of Uninitialized Resource
  • Server-Side Request Forgery
  • Permissive Cross-domain Security Policy with Untrusted Domains
  • Insufficient Granularity of Access Control
  • Improper Validation of Specified Type of Input

Omschrijving

SAP heeft meerdere kwetsbaarheden verholpen in diverse SAP-producten, waaronder SAP NetWeaver Application Server ABAP, SAP NetWeaver AS Java, SAP Web Dispatcher, SAP BusinessObjects Business Intelligence Platform, SAP Cloud SDK, SAP Host Agent, SAP NetWeaver Enterprise Portal, SAP NetWeaver Visual Composer, en SAP Solution Tools Plug-In.

De kwetsbaarheden betreffen verschillende componenten binnen SAP-producten en omvatten onder andere security misconfiguraties, memory corruptie, OS command injection, broken access control, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Server-Side Request Forgery (SSRF), XML External Entity (XXE) aanvallen, code injection, informatielekken, path traversal, en cryptografische zwaktes. Aanvallers kunnen deze kwetsbaarheden misbruiken om onder meer arbitrary code uit te voeren, denial-of-service te veroorzaken, ongeautoriseerde toegang te verkrijgen, gevoelige informatie te lekken, en integriteit van systemen en data aan te tasten. Sommige kwetsbaarheden vereisen geen authenticatie voor exploitatie, terwijl andere misbruik maken van onvoldoende autorisatie- en inputvalidatiecontroles. De kwetsbaarheden zijn aanwezig in zowel ABAP- als Java-componenten, webinterfaces, en SDK's van SAP. Er zijn geen specifieke aanwijzingen voor publiek beschikbare proof-of-concept exploits in de beschrijvingen, maar de technische details geven aan dat exploitatie mogelijk is via speciaal vervaardigde verzoeken of input.

Oplossingen

SAP heeft updates uitgebracht om de kwetsbaarheden in de genoemde producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Referenties

CVE's

Producten

SAP
CRM WebClient UI
Cloud SDK for AI
Cloud SDK for Python
Gateway
Internet Communication Manager
SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
SAP CRM (WebClient UI)
SAP Host Agent
SAP Kernel
SAP Software
SAP Web Dispatcher
SAP Web Dispatcher and Internet Communication Manager
Software
Web Dispatcher
astonish
message_server
netweaver
web_dispatcher
SAP_SE
S4CRM
SAP ABAP Developer Tools (AMDP Data Preview)
SAP Cloud SDK for AI(JavaScript)
SAP Cloud SDK for Python
SAP Gateway
SAP Solution Tools Plug-In (ST-PI)
SAP Start Service and SAP Microsoft Management Console
SAP WebClient UI
SAP/astonish

Disclaimer

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.