CVE-2026-23687: SAP Basis Auth Bypass Vulnerability

CVE-2026-23687 Overview

CVE-2026-23687 affects SAP NetWeaver Application Server ABAP and ABAP Platform. An authenticated attacker with normal privileges can obtain a valid signed message and submit modified signed XML documents to the verifier. The flaw lies in improper verification of cryptographic signatures [CWE-347] on XML messages.

Successful exploitation results in acceptance of tampered identity information. Attackers can gain unauthorized access to sensitive user data and disrupt normal system operations. The vulnerability impacts a broad range of SAP_BASIS releases from version 700 through 918.

Critical Impact
Authenticated attackers can tamper with signed XML documents to spoof identity, access sensitive data, and disrupt SAP NetWeaver operations across nearly two decades of SAP_BASIS releases.

Affected Products

SAP NetWeaver Application Server ABAP — SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758
SAP ABAP Platform — SAP_BASIS 804
SAP ABAP Platform — SAP_BASIS 916, 917, 918

Discovery Timeline

2026-02-10 - CVE-2026-23687 published to NVD
2026-02-17 - Last updated in NVD database

Technical Details for CVE-2026-23687

Vulnerability Analysis

The vulnerability resides in the XML signature verification logic of SAP NetWeaver Application Server ABAP. The verifier accepts signed XML documents without adequately binding the signature to the full content of the message. An authenticated attacker who legitimately obtains a valid signed message can modify portions of the XML and resubmit it. The verifier still treats the document as authentic.

This class of flaw maps to CWE-347: Improper Verification of Cryptographic Signature. Because SAP NetWeaver uses signed XML to convey identity assertions and SOAP message integrity, a successful bypass undermines authentication decisions made downstream. The attacker gains the trust associated with the original signer.

Root Cause

The root cause is incomplete validation of signed XML structures. Verification logic likely processes signatures over a subset of the document, allowing wrapping or substitution of unsigned content while the signature still validates. The verifier does not enforce a strict binding between the signed element and the data it authorizes.

Attack Vector

The attack is network-based and requires low-privilege authenticated access to the SAP system. The attacker first triggers issuance of a valid signed XML message through normal application flows. The attacker then modifies the XML, for example by inserting attacker-controlled elements through XML signature wrapping techniques, and replays the message to the verifier. The verifier accepts the tampered content as authentic.

No public proof-of-concept or exploit code is available at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical detail is limited to vendor advisories; refer to SAP Note #3697567 for verified information.

Detection Methods for CVE-2026-23687

Indicators of Compromise

Repeated SOAP or XML message submissions from a single authenticated user containing structurally similar but not identical signed payloads.
Audit log entries showing identity assertions or privileged actions executed by users who did not interactively perform them.
XML messages where signed elements reference identifiers that do not match the surrounding document structure, indicating signature wrapping.

Detection Strategies

Inspect SAP Security Audit Log (SM19/SM20) for unexpected authentication events tied to signed message processing.
Compare verified signer identity with the effective principal applied to downstream operations to detect divergence.
Apply schema validation in addition to signature validation, rejecting XML containing duplicate IDs or unexpected element placement.

Monitoring Recommendations

Forward SAP Gateway, ICM, and security audit logs to a centralized SIEM and alert on anomalies in signed message workflows.
Track per-user rates of signed XML submissions and flag deviations from baseline activity.
Monitor SAP_BASIS patch levels across the landscape to ensure all systems receive the fix from SAP Note #3697567.

How to Mitigate CVE-2026-23687

Immediate Actions Required

Apply the SAP security patch referenced in SAP Note #3697567 to all affected SAP_BASIS releases.
Inventory all SAP NetWeaver ABAP and ABAP Platform systems and prioritize internet-exposed or federation-connected instances.
Review accounts with normal privileges that can request or receive signed XML messages and revoke unnecessary access.

Patch Information

SAP addressed CVE-2026-23687 through its Security Patch Day process. Customers should consult SAP Note #3697567 for the authoritative correction instructions and refer to the SAP Security Patch Day Update for the broader patch bundle. Apply the corresponding support packages or notes to every affected SAP_BASIS release listed above.

Workarounds

Restrict network access to SAP NetWeaver endpoints that consume signed XML to trusted segments until patches are applied.
Enforce additional application-layer authorization checks that do not rely solely on identity claims contained in signed XML.
Increase audit logging detail on signed-message verifiers to support forensic review while patching is in progress.

bash

# Configuration example
# Verify SAP_BASIS patch level via SAP GUI transaction
# Transaction: SPAM (Support Package Manager)
# Or query system info from ABAP:
#   REPORT zcheck_basis.
#   SELECT name, release, patch_level
#     FROM cvers
#     WHERE component = 'SAP_BASIS'
#     INTO TABLE @DATA(lt_versions).
# Confirm the applied note 3697567 in transaction SNOTE.