CVE-2026-23689

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3703092	Permissions Required
https://url.sap/sapsecuritypatchday	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sap:advanced_planning_and_optimization:713:::::::*
	cpe:2.3:a:sap:advanced_planning_and_optimization:714:::::::*
	cpe:2.3:a:sap:supply_chain_management:700:::::::*
	cpe:2.3:a:sap:supply_chain_management:701:::::::*
	cpe:2.3:a:sap:supply_chain_management:702:::::::*
	cpe:2.3:a:sap:supply_chain_management:712:::::::*

History

No history.

Information

Published : 2026-02-10 04:16

Updated : 2026-02-17 15:57

NVD link : CVE-2026-23689

Mitre link : CVE-2026-23689

CVE.ORG link : CVE-2026-23689

JSON object : View

Products Affected

sap

supply_chain_management
advanced_planning_and_optimization

CWE

CWE-606

Unchecked Input for Loop Condition

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-23689", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "published": "2026-02-10T04:16:03.500", "references": [{"url": "https://me.sap.com/notes/3703092", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-606"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected."}, {"lang": "es", "value": "Debido a una vulnerabilidad de consumo de recursos no controlado (denegaci\u00f3n de servicio), un atacante autenticado con privilegios de usuario regular y acceso a la red puede invocar repetidamente un m\u00f3dulo de funci\u00f3n habilitado remotamente con un par\u00e1metro de control de bucle excesivamente grande. Esto desencadena una ejecuci\u00f3n de bucle prolongada que consume recursos excesivos del sistema, lo que podr\u00eda dejar el sistema no disponible. La explotaci\u00f3n exitosa resulta en una condici\u00f3n de denegaci\u00f3n de servicio que afecta la disponibilidad, mientras que la confidencialidad y la integridad permanecen inafectadas."}], "lastModified": "2026-02-17T15:57:04.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:advanced_planning_and_optimization:713:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E303C34-3616-489F-BEA3-456E302E2D38"}, {"criteria": "cpe:2.3:a:sap:advanced_planning_and_optimization:714:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82CF8FC0-AECD-4ACC-B823-45645A5B2D83"}, {"criteria": "cpe:2.3:a:sap:supply_chain_management:700:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A19AC4DB-E940-46AC-9E3D-4108B3F07BC0"}, {"criteria": "cpe:2.3:a:sap:supply_chain_management:701:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0A1E0EC-CA14-4AA4-A798-E4E9AD59E45B"}, {"criteria": "cpe:2.3:a:sap:supply_chain_management:702:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0B74ECC-DC88-4171-B091-49BD76491336"}, {"criteria": "cpe:2.3:a:sap:supply_chain_management:712:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9172B1E7-CEDA-4A60-9915-E744FC1319FC"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}