CVE-2026-23689CWE-606

Denial of service (DOS) in SAP Supply Chain Management

High · published February 10, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
34.3
In the wild
Unconfirmed
What it is

⚡ A crafty authenticated user can trigger a denial-of-service condition with just one function call — it's like an overzealous chef who keeps ordering ingredients without stopping, eventually stuffing the kitchen! 🔥 Imagine a restaurant where one customer keeps ordering more and more dishes, overwhelming the kitchen staff and leaving everyone else waiting for their meals. This vulnerability acts like that, creating a bottleneck that stops everything else from functioning properly. If exploited, this vulnerability could bring your system to a screeching halt, leaving legitimate users unable to access services or complete tasks. While your data stays safe, the frustration of downtime could be absolutely devastating for your operations and reputation.

Put simply

Imagine a restaurant where one customer keeps ordering more and more dishes, overwhelming the kitchen staff and leaving everyone else waiting for their meals. This vulnerability acts like that, creating a bottleneck that stops everything else from functioning properly. This uncontrolled resource consumption vulnerability allows an authenticated attacker to invoke a remote function with a massive loop-control parameter, leading to excessive resource consumption and potential system unavailability.

What to do

If exploited, this vulnerability could bring your system to a screeching halt, leaving legitimate users unable to access services or complete tasks. While your data stays safe, the frustration of downtime could be absolutely devastating for your operations and reputation. To mitigate this issue, ensure that you limit loop-control parameters in remote-enabled function modules. Additionally, monitor system performance to identify any unusual activity and consider applying a patch or updating to a more robust version as soon as it's available. You've got this! With these steps, you'll keep your system running smoothly and protect against this sneaky DoS vulnerability. 🛡️

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00411 · 34.3th percentile
Weakness
CWE-606 · Unchecked Input for Loop Condition
Published
2026-02-10T03:03Z
EPSS history
Timeline
  • 10 FEB 03:03Z
    Denial of service (DOS) in SAP Supply Chain Management
    cvelistv5