SAP NetWeaver Command Injection (January 2026)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(288282);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/10");

  script_cve_id("CVE-2026-0507");
  script_xref(name:"IAVB", value:"2026-A-0031");

  script_name(english:"SAP NetWeaver Command Injection (January 2026)");

  script_set_attribute(attribute:"synopsis", value:
"The remote SAP NetWeaver application server is affected by a Command Injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of SAP NetWeaver Application Server for Java detected on the remote host is affected by an
SAP NetWeaver is affected by a server-side request forgery (SSRF) vulnerabilityas disclosed in the SAP 
Security Patch Day January 2026:
 
 - Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, 
   an authenticated attacker with administrative access and adjacent network access could upload 
   specially crafted content to the server. If processed by the application, this content enables 
   execution of arbitrary operating system commands. Successful exploitation could lead to full 
   compromise of the system’s confidentiality, integrity, and availability. (CVE-2026-0507)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://support.sap.com/en/my-support/knowledge-base/security-notes-news/january-2026.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?02c0a10f");
  script_set_attribute(attribute:"see_also", value:"https://me.sap.com/notes/3675151");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:M/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-0507");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/16");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:sap:netweaver_application_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("sap_netweaver_as_web_detect.nbin");
  script_require_keys("installed_sw/SAP Netweaver Application Server (AS)", "Settings/ParanoidReport");
  script_require_ports("Services/www", 80, 443, 8000, 50000);

  exit(0);
}

include('vcf_extras_sap.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var app_info = vcf::sap_netweaver_as::get_app_info(kernel:TRUE);

var fix = 'See vendor advisory';
var constraints = [
{ 'equal' : '753' , 'fixed_display': fix },
{ 'equal' : '754' , 'fixed_display': fix },
{ 'equal' : '777' , 'fixed_display': fix },
{ 'equal' : '789' , 'fixed_display': fix },
{ 'equal' : '793' , 'fixed_display': fix },
{ 'equal' : '916' , 'fixed_display': fix }
];

vcf::sap_netweaver_as::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE,
  kernel:TRUE
);