CVE-2026-23689: Denial of service (DOS) in SAP Supply Chain Management

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-10 · updated 2026-06-17
Weakness: CWE-606

Description

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.

Affected products

SAP Advanced Planning And Optimization: 713, 714
SAP Supply Chain Management: 700, 701, 702, 712

References

Get alerted when CVE-2026-23689 or the next vulnerability affects your stack