Description

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the application.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-08T01:17:51.987Z",
  "pubdate": "2026-09-08T01:17:51.987Z",
  "executiveSummary": "This vulnerability pertains to a session hijacking flaw within the SAP NetWeaver Application Server for ABAP and the ABAP Platform.\nThe vulnerability allows an unauthenticated remote attacker to potentially compromise the integrity and confidentiality of legitimate user sessions.\nBy transmitting a specially crafted packet, an attacker can influence the server's internal request processing mechanism, specifically triggering the unauthorized reprocessing of buffered user requests.\nExploitation is contingent upon specific, narrow timing conditions, requiring precise coordination with existing server traffic.\nThe impact is rated as high regarding confidentiality and integrity, as successful exploitation enables session impersonation, while the impact on system availability is assessed as low.\nNo authentication is required to initiate the attack, making it a significant threat to internal and exposed SAP environments.\nOrganizations are advised to prioritize security patching and implement strict network access controls to mitigate unauthorized access to the application server interface.",
  "technicalDetails": "The vulnerability resides within the request handling and buffering architecture of the SAP NetWeaver Application Server for ABAP and ABAP Platform.\nThe root cause involves an improper state management mechanism during the processing of buffered network packets. Specifically, the server fails to adequately isolate or cryptographically bind buffered request data to the originating session context before the final execution phase.\nThe attack flow begins with the attacker monitoring network traffic to identify established active sessions or to prepare the server's buffer state. The attacker then injects a specially crafted, unauthenticated packet designed to manipulate the server's request internal queue. This packet exploits the server's logic for re-evaluating or re-processing buffered requests.\nUnder precise timing conditions, the server mistakenly associates the attacker's request payload with the context of a legitimate, previously buffered request from another user. Because the application server is forced to re-evaluate the buffered buffer, the attacker can hijack the session token or execution context associated with the legitimate user.\nThis manipulation bypasses standard authentication and authorization checks, as the server treats the reprocessed packet as a continuation of a valid, established transaction.\nSuccessful exploitation allows for arbitrary action execution within the context of the victim's session. Depending on the privileges assigned to the hijacked user, the impact can escalate to administrative control, unauthorized data exfiltration, or modification of critical business information within the ABAP environment.\nThe vulnerability is primarily network-exposed, meaning any segment capable of reaching the SAP application server ports can serve as an attack vector. The reliance on 'narrow timing conditions' suggests that the attack may require multiple attempts or sophisticated traffic injection tools to achieve successful synchronization with the target's session activities.\nPost-exploitation, the attacker maintains the ability to perform operations as the victim until the hijacked session expires or is manually terminated by administrators."
}