What is the CVSS score of CVE-2026-23686?

CVE-2026-23686 has a CVSS 3.1 base score of 3.4 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of SAP are affected by CVE-2026-23686?

CVE-2026-23686 is a low-severity vulnerability (CVSS 3.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

How to fix or mitigate CVE-2026-23686?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

SAP CVE-2026-23686

LOW

HTTP Response Splitting (CWE-113)

2026-02-10 cna@sap.com

SAP

3.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.4 LOW

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 04:16 nvd

LOW 3.4

DescriptionCVE.org

Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.

AnalysisAI

Netweaver Application Server Java versions up to 7.50 is affected by http response splitting (CVSS 3.4).

Technical ContextAI

This vulnerability (CWE-113: HTTP Response Splitting) affects Netweaver Application Server Java. Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.