CVE-2026-23686
CRLF Injection vulnerability in SAP NetWeaver Application Server Java
Reported by sap · Published February 10, 2026
Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP NetWeaver Application Server Java | LMNWABASICAPPS 7.50 |
| SAP_SE | SAP NetWeaver Application Server Java | 7.50 |
Timeline
- Feb 9, 2026 CVE Published
- Feb 10, 2026 EPSS Score (30 in total, the first dated here)
- Feb 10, 2026 CVE Updated
- Mar 17, 2026 Security Advisory (3 in total, the first dated here)
- Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-23686
vulnetix vdb fixes CVE-2026-23686Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-23686/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart