Description

SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tables that control access to data objects during specific operations. These unauthorized modifications could result in processing delays and operational disruption, leading to a low impact on the integrity and availability of the application with no impact on confidentiality.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-11T01:17:22.047Z",
  "pubdate": "2026-08-11T01:17:22.047Z",
  "executiveSummary": "This vulnerability affects SAP NetWeaver and ABAP Platform, specifically within the Change and Transport System (Customer Transport Integration Wizard). The flaw allows a low-privileged authenticated user to perform unauthorized modifications to critical configuration tables that dictate access controls for data objects during designated system operations. Successful exploitation of this vulnerability directly undermines the integrity and availability of the target application, resulting in processing delays and operational disruption.\nThe risk implication is constrained to integrity and availability impacts, with confidentiality remaining unaffected. The attack requires low privileges, specifically the ability to interact with the Change and Transport System's Customer Transport Integration Wizard, but does not necessitate complex exploitation prerequisites beyond standard user authentication within the ecosystem.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient authorization validation and access control enforcement within the Change and Transport System (Customer Transport Integration Wizard) component of SAP NetWeaver and ABAP Platform. Specifically, the application fails to adequately restrict low-privileged users from writing to or altering sensitive configuration tables that govern data object access logic during specific execution phases.\nThe vulnerable component is the Change and Transport System, which handles software logistics and transport management in SAP environments. Exploitation occurs when an authenticated user with low privileges interacts with the Customer Transport Integration Wizard and issues unauthorized modification requests targeted at these access-control configuration tables.\nThe attack flow proceeds as follows: First, the low-privileged attacker authenticates to the SAP NetWeaver or ABAP Platform environment. Second, the attacker invokes the Change and Transport System (Customer Transport Integration Wizard) functionality. Third, by leveraging inadequate server-side authorization checks, the attacker submits crafted modification commands directed at internal configuration tables controlling data object accessibility. Finally, the application processes these unauthorized changes, corrupting the intended access policies.\nPost-exploitation impact is characterized by operational disruption and processing delays within the application lifecycle. Because the modified configuration tables dictate how data objects are accessed during specific operations, the unauthorized alterations induce system instability, anomalous processing behavior, and denial of expected transactional workflows. The vulnerability exhibits no impact on data confidentiality."
}