CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- SAP NetWeaver Missing Authentication for Critical Function Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
Affected products
sap: netweaver application server java
References10
- launchpad.support.sap.com/#/notes/2934135 Permissions RequiredVendor Advisory
- wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 Broken LinkVendor Advisory
- launchpad.support.sap.com/#/notes/2934135 Permissions RequiredVendor Advisory
- wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 Broken LinkVendor Advisory
- packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Tas… Third Party AdvisoryVDB Entry
- seclists.org/fulldisclosure/2021/Apr/6 Mailing ListThird Party Advisory
- www.onapsis.com/recon-sap-cyber-security-vulnerability Third Party Advisory
- packetstormsecurity.com/files/162085/SAP-JAVA-Configuration-Tas… Third Party AdvisoryVDB Entry
- seclists.org/fulldisclosure/2021/Apr/6 Mailing ListThird Party Advisory
- www.onapsis.com/recon-sap-cyber-security-vulnerability Third Party Advisory
Metrics
- CVSS 3.1
-
10.0
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 95% percentile: 100 · as of 2 November 2026
- CWE
- CWE-306