What’s Vulnerable › Vulnerabilities

CVE-2026-0510: Obsolete Encryption Algorithm Used in NW AS Java UME User Mapping

• Severity: low (CVSS 3.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-13 · updated 2026-06-17
• Weakness: CWE-326

Description

The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping data. This weakness could allow an attacker with high-privileged access to exploit the vulnerability under specific conditions potentially leading to partial disclosure of sensitive information.This has low impact on confidentiality with no impact on integrity and availability of the application.

Affected products

• SAP_SE NW AS Java UME User Mapping: ENGINEAPI 7.50, SERVERCORE 7.50, UMEADMIN 7.50

References

• https://me.sap.com/notes/3593356
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-0510 or the next vulnerability affects your stack