CVE-2025-26657: SAP KMC WPC Information Disclosure Flaw

CVE-2025-26657 Overview

CVE-2025-26657 is an information disclosure vulnerability in SAP Knowledge Management and Collaboration Web Page Composer (KMC WPC). An unauthenticated remote attacker can retrieve valid usernames by issuing a crafted parameter query against the exposed component. The flaw is categorized as Missing Authorization [CWE-862] and has no impact on integrity or availability. Exploitation requires no authentication, no user interaction, and can be performed over the network.

Critical Impact
Unauthenticated attackers can enumerate application usernames remotely, enabling reconnaissance for follow-on credential stuffing, password spraying, and targeted phishing campaigns.

Affected Products

SAP Knowledge Management and Collaboration (KMC) Web Page Composer
Refer to SAP Note #3568307 for the specific supported package versions covered by the fix
SAP NetWeaver deployments exposing KMC WPC to untrusted networks

Discovery Timeline

2025-04-08 - CVE-2025-26657 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26657

Vulnerability Analysis

The vulnerability resides in a query interface exposed by SAP KMC WPC. The component processes a parameter that returns username information without first verifying the caller's authorization. An attacker sends a simple HTTP request to the affected endpoint and receives valid usernames from the backing directory or user store.

Username enumeration reduces the search space for downstream attacks. Once valid identities are known, adversaries can target them with password spraying, credential stuffing using leaked datasets, or spear-phishing tuned to the enumerated account owners. The confidentiality impact is scoped to disclosed identifiers, so integrity and availability are unaffected.

The issue affects internet-exposed portals in particular. SAP enterprise portals often federate identity with Active Directory or LDAP-backed stores, which means a leaked username maps directly to an authentication target elsewhere in the environment. The current EPSS probability is 0.305%.

Root Cause

The root cause is a missing authorization check [CWE-862] on a KMC WPC query handler. The handler returns user information based solely on the supplied parameter without validating that the requester has permission to view that data.

Attack Vector

Exploitation is remote and network-based. An attacker issues an unauthenticated HTTP request containing the vulnerable parameter to the KMC WPC endpoint. The response contains a valid username, which the attacker can iterate against a wordlist or numeric identifier range to harvest accounts at scale. No verified public proof-of-concept exploit code is available, and the vulnerability is not listed in CISA KEV. See the SAP Note #3568307 for vendor technical details.

Detection Methods for CVE-2025-26657

Indicators of Compromise

Repeated unauthenticated HTTP requests to KMC WPC endpoints containing user-lookup parameters from a single source address
High-volume enumeration patterns where a single client iterates numeric or alphabetical values against the same parameter
Anomalous response-size distributions on KMC WPC endpoints indicating positive versus negative username matches

Detection Strategies

Inspect SAP NetWeaver ICM and web dispatcher logs for unauthenticated requests to KMC WPC URLs returning HTTP 200 responses
Baseline normal traffic to portal endpoints and alert on request rate spikes lacking session cookies or authentication headers
Correlate portal enumeration attempts with subsequent authentication failures against the same usernames on Active Directory, Entra ID, or SAP logon services

Monitoring Recommendations

Enable verbose HTTP access logging on SAP NetWeaver components hosting KMC WPC and forward logs to a centralized analytics platform
Monitor perimeter and WAF telemetry for scripted access patterns targeting portal query parameters
Track authentication failure rates for accounts recently referenced in KMC WPC query responses

How to Mitigate CVE-2025-26657

Immediate Actions Required

Apply the SAP security patch referenced in SAP Note #3568307 during the next available maintenance window
Restrict network exposure of KMC WPC endpoints to authenticated internal users where business requirements permit
Review web server and portal logs for prior enumeration activity dating back to before the patch was applied

Patch Information

SAP released the fix as part of its monthly SAP Security Patch Day program. Administrators should download and apply the correction instructions from SAP Note #3568307 using the SAP Support Launchpad. Verify the patch level of KMC WPC components after installation.

Workarounds

Place a reverse proxy or web application firewall in front of SAP NetWeaver and block unauthenticated access to KMC WPC query endpoints
Enforce IP allow-listing for portal administration and content composition URLs until the patch can be deployed
Rotate credentials for any accounts confirmed to have been enumerated and enable multi-factor authentication where supported

bash

# Example WAF rule concept to block unauthenticated KMC WPC queries
# Adapt path and parameter names to your deployment per SAP Note #3568307
SecRule REQUEST_URI "@contains /irj/servlet/prt/portal" \
  "phase:1,deny,status:403,\
   chain,\
   msg:'Block unauthenticated KMC WPC user query'"
  SecRule &REQUEST_COOKIES:MYSAPSSO2 "@eq 0"