CVE-2026-40135

6.5 MEDIUM

An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authentica...

Published: 2026-05-12 · Last updated: 2026-06-03

Severity and scoring

CVSS: 6.5 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CWE: CWE-77

Affected products

Vendor	Product
sap	netweaver_application_server_abap

Description

An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of unintended OS commands without detection, potentially impacting the integrity and availability of the application, with no impact on confidentiality.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-40135
[Other]https://me.sap.com/notes/3730019
[Vendor advisory]https://url.sap/sapsecuritypatchday

Related CVEs

Same vendor

CVE-2026-27680 — Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascad... (3.1 LOW)
CVE-2026-27682 — Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Serv... (4.7 MEDIUM)
CVE-2026-34257 — Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL tha... (6.1 MEDIUM)
CVE-2026-27674 — Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could suppl... (6.1 MEDIUM)
CVE-2026-27688 — Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could r... (5.0 MEDIUM)

Same CWE

CVE-2026-46529 — Atril Document Viewer is the default document reader of the MATE desktop environment for Linux
CVE-2026-45558 — Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers (9.9 CRITICAL)
CVE-2026-11572 — Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation ... (8.8 HIGH)
CVE-2026-11556 — A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9 (8.8 HIGH)
CVE-2026-11487 — A flaw has been found in Neovim up to 0.12.2 (5.3 MEDIUM)