CVE-2026-23686CWE-113

CRLF Injection vulnerability in SAP NetWeaver Application Server Java

Low · published February 10, 2026

CVSS v3.1
3.4
EPSS
0%
Percentile
8.7
In the wild
Unconfirmed
What it is

Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.

The record
Technical detail
CVSS v3.1
3.4 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00195 · 8.7th percentile
Weakness
CWE-113 · Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Published
2026-02-10T03:02Z
EPSS history
Timeline
  • 10 FEB 03:02Z
    CRLF Injection vulnerability in SAP NetWeaver Application Server Java
    cvelistv5