Medium severity · published May 12, 2026
CVE-2026-40135
OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
6.5
CVSS
1.4%
EPSS
No
On KEV
Description
An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of unintended OS commands without detection, potentially impacting the integrity and availability of the application, with no impact on confidentiality.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver Application Server for ABAP and ABAP Platform · SAP_SE
SAP_BASIS 700; SAP_BASIS 701; SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; +9 more · source: vendor
NA
Netweaver Application Server Abap · Sap
700; 701; 702; 731; 740; 750; +9 more · source: NVD
Affected product
SN
SAP NetWeaver Application Server for ABAP and ABAP Platform
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40135
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40135
Permissions Required
https://me.sap.com/notes/3730019
Vendor Advisory
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver Application Server for ABAP and ABAP Platform
7.7
CVE-2026-66767
Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
5.4
CVE-2024-45285
Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
5.4
CVE-2024-44117
Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
5.4
CVE-2024-42371
Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
4.3
CVE-2024-44116
Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
