Advanced Planning And Optimization
CVE-2026-23689
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as regular user
-
DeliveryAccess remote-enabled function module
-
ExploitSupply excessively large loop-control parameter
-
ExecutionTrigger prolonged loop execution
-
PersistExhaust system resources
-
ImpactRender system unavailable
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Unchecked input for loop condition
|
| Exploitation Conditions | Authenticated user account with regular privileges required. Target system must have remote-enabled function module exposed and accessible to authenticated users. Attacker must have network access to the vulnerable function module endpoint. |
| Impact | CVSS 7.7 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker (requires authentication) could exploit this flaw, a denial-of-service condition that impacts availability, whi. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Denial-of-service vulnerability in SAP Advanced Planning And Optimization and Supply Chain Management allows authenticated users to exhaust system resources by repeatedly calling a remote function module with oversized parameters, causing service unavailability. An attacker with standard user credentials and network access can trigger prolonged resource consumption that may render the affected system unresponsive. No patch is currently available.
Earlier versions of this analysis (1)
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. [CVSS 7.7 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects Advanced Planning And Optimization. Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality a
Know when Advanced Planning And Optimization gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.
Executive ViewAI
An authenticated user can exploit a denial-of-service vulnerability in a remote-enabled function to consume excessive system resources and disrupt service availability. This requires valid credentials but poses a significant operational risk to dependent business systems until a patch becomes available.
Implement rate limiting and request throttling via WAF or network appliances targeting the vulnerable function; restrict network access to the affected module through firewall rules limiting source IPs; disable the remote-enabled function if not business-critical; apply input validation rules to reject excessively large loop-control parameters; increase system monitoring and alerting for DoS patterns; segment network access using zero-trust principles to limit authenticated user scope.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB