CVE-2026-40135 OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

Medium 6.5 Published 12 May 2026 Updated 12 May 2026

Authenticated administrators can execute OS commands bypassing logging, impacting integrity and availability of SAP NetWeaver ABAP servers.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-40135?

CVE-2026-40135 is a medium-severity command injection vulnerability in Sap Netweaver Application Server Abap, published on 12 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of unintended OS commands without detection, potentially impacting the integrity and availability of the application, with no impact on confidentiality.

Weakness: CWE-77

Which versions are affected by CVE-2026-40135?

It affects 1 product.

Products include Sap Netweaver Application Server Abap.

How do I fix CVE-2026-40135?

No fix has been published for CVE-2026-40135 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-40135 being exploited?

There is no known exploitation of CVE-2026-40135 in the wild and no public exploit code.

All Sap Netweaver Application Server Abap vulnerabilities

Sources

Also known as GHSA-8w5g-hw8f-fqqg.