What is the CVSS score of CVE-2026-23689?

CVE-2026-23689 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Advanced Planning And Optimization are affected by CVE-2026-23689?

An authenticated user can exploit a denial-of-service vulnerability in a remote-enabled function to consume excessive system resources and disrupt service availability.

How to fix or mitigate CVE-2026-23689?

Within 24 hours: Identify all systems running the affected module and restrict network access to authorized users only; document current user privilege levels. Within 7 days: Implement compensating controls including WAF rules to throttle or block excessive loop parameters, disable the vulnerable function if operationally feasible, or isolate affected systems to a segmented network. Within 30 days: Monitor vendor communications for patch availability; conduct a user access review to eliminate unnecessary authenticated accounts with function module privileges.

Advanced Planning And Optimization CVE-2026-23689

HIGH

Unchecked Input for Loop Condition (CWE-606)

2026-02-10 cna@sap.com

Denial Of Service Advanced Planning And Optimization Supply Chain Management

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 04:16 nvd

HIGH 7.7

DescriptionCVE.org

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.

AnalysisAI

Denial-of-service vulnerability in SAP Advanced Planning And Optimization and Supply Chain Management allows authenticated users to exhaust system resources by repeatedly calling a remote function module with oversized parameters, causing service unavailability. An attacker with standard user credentials and network access can trigger prolonged resource consumption that may render the affected system unresponsive. No patch is currently available.

Technical ContextAI

Affects Advanced Planning And Optimization. Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality a