轉發 台灣電腦網路危機處理暨協調中心 資安訊息警訊 TWCERTCC-200-202606-00000009
[內容說明]
【CVE-2026-40128，CVSS：9.0】 SAP NetWeaver Application Server Java (Web Container)允許未經身分驗證的攻擊者，透過精心設計HTTP登入請求進而觸發路徑遍歷行為。
【CVE-2026-27671，CVSS：9.8】 由於SAP NetWeaver AS ABAP and ABAP Platform 所使用的RFC協定驗證不足，未經身分驗證的攻擊者可透過精心設計的RFC請求，利用記憶體的邏輯錯誤進而損壞。
【CVE-2026-44748，CVSS：9.9】 SAP NetWeaver AS ABAP and ABAP Platform允許具有普通權限且經身分驗證的攻擊者取得有效簽署訊息後，對簽署文件內容進行竄改後提交給驗證者。
[影響平台]
SAP NetWeaver AS ABAP and ABAP Platform Version(s) - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 722EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 91.9
SAP NetWeaver AS ABAP and ABAP Platform Version(s) - SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 918, SAP_BASIS 919
SAP NetWeaver Application Server Java (Web Container) Version(s) - ENGINEAPI 7.50
[建議措施]
根據官方網站釋出的解決方式進行修補： https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2026.html
[參考資料]
1. https://www.twcert.org.tw/tw/cp-169-10963-9280d-1.html
Forwarded from Taiwan Computer Network Crisis Management and Coordination Center: Cybersecurity Alert TWCERTCC-200-202606-00000009
[Content Description]
【CVE-2026-40128, CVSS: 9.0】SAP NetWeaver Application Server Java (Web Container) allows unauthenticated attackers to trigger path traversal behavior through carefully crafted HTTP login requests.
【CVE-2026-27671, CVSS: 9.8】Due to insufficient validation of the RFC protocol used by SAP NetWeaver AS ABAP and ABAP Platform, unauthenticated attackers can exploit logical errors in memory through carefully crafted RFC requests to cause damage.
【CVE-2026-44748, CVSS: 9.9】SAP NetWeaver AS ABAP and ABAP Platform allows an attacker with ordinary privileges and verified identity to obtain a valid signature message, then tamper with the signed document and submit it to the verifier.
[Influence Platform]
SAP NetWeaver AS ABAP and ABAP Platform Version(s) - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 722EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 91.9
SAP NetWeaver AS ABAP and ABAP Platform Version(s) - SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 918, SAP_BASIS 919
SAP NetWeaver Application Server Java (Web Container) Version(s) - ENGINEAPI 7.50
[Recommended Action]
Patch according to the solution released on the official website: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2026.html
[References]
1. https://www.twcert.org.tw/tw/cp-169-10963-9280d-1.html