What is CVE-2026-23685?

CVE-2026-23685 is a medium-severity vulnerability in Sap Netweaver, classified under Deserialization of Untrusted Data. CVSS score: 4.4/10. Published 2026-02-10.

How severe is CVE-2026-23685?

Medium severity. CVSS v3 base score is 4.4 out of 10.

Deserialization in Sap Netweaver

CVE-2026-23685

Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content coul…

Vulnerability class: Insecure Deserialization

EPSS: 0.001 (2.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.

Affected products

Sap Netweaver — versions 7.50
Sap_se Sap Netweaver (Jms Service) — versions J2EE-FRMW 7.50

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

cna@sap.com (Permissions Required)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2026-23685?: CVE-2026-23685 is a medium-severity vulnerability in Sap Netweaver, classified under Deserialization of Untrusted Data. CVSS score: 4.4/10. Published 2026-02-10.
How severe is CVE-2026-23685?: Medium severity. CVSS v3 base score is 4.4 out of 10.