# CVE-2026-120017

Auth bypass in SAP NetWeaver/ABAP enabling privileged user impersonation and full compromise.

- Page: https://www.vulneraibility.com/cve/CVE-2026-120017
- CVSS: 10.0
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-347
- Published: 2026-11-10

## Affected versions

- SAP_SE SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider): affected SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; SAP_BASIS 751; SAP_BASIS 752; SAP_BASIS 753; SAP_BASIS 754; SAP_BASIS 755; SAP_BASIS 756; SAP_BASIS 757; SAP_BASIS 758; SAP_BASIS 816; SAP_BASIS 920; SAP_BASIS 921; SAP_BASIS 922

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated attacker can bypass authentication, impersonate privileged users, achieve full system compromise and lateral movement to connected systems.

## Action

Immediate action required

## Recommendation

Apply SAP Note 3849308 patches immediately and disable vulnerable auth assertion configs.

## References

- [other] https://me.sap.com/notes/3849308
- [other] https://url.sap/sapsecuritypatchday

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.