CVE-2026-40129 Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform
An authenticated attacker can inject code via crafted inputs, leading to arbitrary code execution for other users in SAP NetWeaver ABAP.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40129?
CVE-2026-40129 is a medium-severity code injection vulnerability in SAP_SE SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, published on 12 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, an authenticated attacker could send specially crafted inputs to the application. If processed by the application, this input could be delivered to users subscribed to the channel and result in execution. Successful exploitation could enable the attacker to execute arbitrary code for other users, resulting in a low impact on the integrity, with no impact to the confidentiality and availability of the system.
Weakness: CWE-94
Which versions are affected by CVE-2026-40129?
How do I fix CVE-2026-40129?
No fix has been published for CVE-2026-40129 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-40129 being exploited?
There is no known exploitation of CVE-2026-40129 in the wild and no public exploit code.
Sources
Also known as GHSA-f762-3chp-r6jr.