SAP Application Server ABAP CVE-2026-40129

The attacker must possess valid authentication credentials to access the SAP Application Server ABAP. The vulnerability specifically requires the ability to submit input to a notification or subscription channel mechanism that processes user-supplied data and delivers it to other subscribed users. No special configuration is implied; the vulnerability affects standard channel processing functionality. The code execution occurs in the context of receiving users' sessions, not the attacker's session, meaning exploitation is limited to the scope of users subscribed to the targeted channel. The low attack complexity (AC:L) indicates that once authenticated, the exploit is straightforward and does not require special timing, race conditions, or user interaction from victims.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) indicates network accessibility with low attack complexity and authenticated access requirement, resulting in a base score of 4.3 (low). However, multiple risk factors elevate practical concern: (1) The impact scope is User-to-User (S:U), meaning authenticated attackers can inject code that executes in the context of other users, effectively enabling privilege escalation or lateral movement within the same application scope; (2) No special configuration or user interaction is required (AC:L, UI:N), making exploitation reliably repeatable once authenticated access is obtained; (3) The 'RCE' tag in source data suggests the practical impact may exceed the 'low integrity' CVSS assessment, though CVSS vector limits impact to I:L; (4) No KEV (CISA Known Exploited Vulnerability) status or public POC identified in provided data, suggesting this is not yet actively weaponized in the wild. The apparent gap between tag classification ('RCE') and CVSS scoring (I:L) warrants clarification-verify whether actual code execution occurs in other users' sessions or if CVSS accurately reflects impact as integrity-only (e.g., injection of malicious content without execution). For organizations operating SAP systems with multiple authenticated users, the cross-user impact and network accessibility present meaningful insider-threat risk despite the low CVSS score.

An authenticated user (e.g., with basic application access) sends specially crafted input containing code injection payload through a notification or message channel feature. When the system delivers this message to subscribed users, the injected code is executed in the context of the recipient's session. This could allow the attacker to steal session data, modify business objects visible to other users, or escalate privileges if the subscribed users have higher role permissions than the attacker.