What is CVE-2023-0014?

CVE-2023-0014 is a critical-severity vulnerability in SAP Netweaver Abap Server And Platform, classified under Authentication Bypass by Capture-replay. CVSS score: 9.0/10. Published 2023-01-10.

How severe is CVE-2023-0014?

Critical severity. CVSS v3 base score is 9.0 out of 10.

Is CVE-2023-0014 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in SAP Netweaver Abap Server And Platform

CVE-2023-0014

SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates information about system identity in an ambiguous format. This could lead to capture-replay vulnerability and may be exploited by malicious users to obtain illegitimate access to the system.

Published 2023-01-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.007 (52.0th percentile), scored 2026-10-18.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 52nd percentile — 52.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000

Affected products

SAP Netweaver Abap Server And Platform — versions SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 710
SAP Netweaver Application Server Abap — versions 700, 701, 702
SAP Netweaver Application Server Abap Kernel — versions 7.22, 7.53, 7.77
SAP Netweaver Application Server Abap Krnl64nuc — versions 7.22, 7.22ext
SAP Netweaver Application Server Abap Krnl64uc — versions 7.22, 7.22ext, 7.53

Weakness classification (CWE)

CWE-294 — Authentication Bypass by Capture-replay

Public proof-of-concept exploits

SAP-samples/security-services-tools

References

launchpad.support.sap.com/ (Permissions Required, Vendor Advisory)
www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (Vendor Advisory)

Frequently asked questions

What is CVE-2023-0014?: CVE-2023-0014 is a critical-severity vulnerability in SAP Netweaver Abap Server And Platform, classified under Authentication Bypass by Capture-replay. CVSS score: 9.0/10. Published 2023-01-10.
How severe is CVE-2023-0014?: Critical severity. CVSS v3 base score is 9.0 out of 10.
Is CVE-2023-0014 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.