CVE-2026-23686

The record

Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.

Affected packages

Related vulnerabilities

• CVE-2026-2811 The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection… CWE-113
• CVE-2026-77341 cpp-httplib is a C++ header-only HTTP/HTTPS library. CWE-113
• CVE-2026-75419 go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. CWE-113
• CVE-2026-50576 ePA 3.x Integration implements the authorization workflow and writes Medical Information… CWE-113
• CVE-2026-54163 secure_headers manages application of security headers with many safe defaults. CWE-113
• CVE-2026-50188 Kirby is an open-source content management system. CWE-113
• CVE-2026-55766 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. CWE-113
• CVE-2026-50269 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-113