SAP NetWeaver AS Java Sensitive Information Vulnerability (January 2026)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(288280);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/10");

  script_cve_id("CVE-2026-0510");
  script_xref(name:"IAVB", value:"2026-A-0031");

  script_name(english:"SAP NetWeaver AS Java Sensitive Information Vulnerability (January 2026)");

  script_set_attribute(attribute:"synopsis", value:
"The remote SAP NetWeaver application server is affected by an Information Disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of SAP NetWeaver Application Server for Java detected on the remote host is affected by an
Sensitive Information vulnerability as disclosed in the SAP Security Patch Day January 2026:

  - The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an 
    obsolete cryptographic algorithm for encrypting User Mapping data. This weakness could allow an attacker 
    with high-privileged access to exploit the vulnerability under specific conditions potentially leading to 
    partial disclosure of sensitive information. (CVE-2026-0510)

Note that Nessus has not tested for these issue but has instead relied only on the application's self-reported version
number.");
  # https://support.sap.com/en/my-support/knowledge-base/security-notes-news/january-2026.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?02c0a10f");
  script_set_attribute(attribute:"see_also", value:"https://me.sap.com/notes/3593356");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:M/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-0510");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/16");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:sap:netweaver_application_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("sap_netweaver_as_web_detect.nbin");
  script_require_keys("installed_sw/SAP Netweaver Application Server (AS)", "Settings/ParanoidReport");
  script_require_ports("Services/www", 80, 443, 8000, 50000);

  exit(0);
}

include('vcf_extras_sap.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var app_info = vcf::sap_netweaver_as::get_app_info();

var constraints = [
  {'equal' : '7.50', 'fixed_display' : 'See vendor advisory' }
];

vcf::sap_netweaver_as::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_NOTE
);