【資安漏洞預警】SAP針對旗下多款產品發布重大資安公告

【行政公告】

公告單位	圖資處數位服務組
訊息類別	行政公告行政公告	公告對象	全體
公告主題	【資安漏洞預警】SAP針對旗下多款產品發布重大資安公告 [Security Vulnerability Alert] SAP Issues Major Cybersecurity Announcement for Multiple Products
公告內容	轉發台灣電腦網路危機處理暨協調中心資安訊息警訊 TWCERTCC-200-202606-00000009 [內容說明] 【CVE-2026-40128，CVSS：9.0】 SAP NetWeaver Application Server Java (Web Container)允許未經身分驗證的攻擊者，透過精心設計HTTP登入請求進而觸發路徑遍歷行為。【CVE-2026-27671，CVSS：9.8】由於SAP NetWeaver AS ABAP and ABAP Platform 所使用的RFC協定驗證不足，未經身分驗證的攻擊者可透過精心設計的RFC請求，利用記憶體的邏輯錯誤進而損壞。【CVE-2026-44748，CVSS：9.9】 SAP NetWeaver AS ABAP and ABAP Platform允許具有普通權限且經身分驗證的攻擊者取得有效簽署訊息後，對簽署文件內容進行竄改後提交給驗證者。 [影響平台] SAP NetWeaver AS ABAP and ABAP Platform Version(s) - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 722EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 91.9 SAP NetWeaver AS ABAP and ABAP Platform Version(s) - SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 918, SAP_BASIS 919 SAP NetWeaver Application Server Java (Web Container) Version(s) - ENGINEAPI 7.50 [建議措施] 根據官方網站釋出的解決方式進行修補： https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2026.html [參考資料] 1. https://www.twcert.org.tw/tw/cp-169-10963-9280d-1.html Forwarded from Taiwan Computer Network Crisis Management and Coordination Center: Cybersecurity Alert TWCERTCC-200-202606-00000009 [Content Description] 【CVE-2026-40128, CVSS: 9.0】SAP NetWeaver Application Server Java (Web Container) allows unauthenticated attackers to trigger path traversal behavior through carefully crafted HTTP login requests. 【CVE-2026-27671, CVSS: 9.8】Due to insufficient validation of the RFC protocol used by SAP NetWeaver AS ABAP and ABAP Platform, unauthenticated attackers can exploit logical errors in memory through carefully crafted RFC requests to cause damage. 【CVE-2026-44748, CVSS: 9.9】SAP NetWeaver AS ABAP and ABAP Platform allows an attacker with ordinary privileges and verified identity to obtain a valid signature message, then tamper with the signed document and submit it to the verifier. [Influence Platform] SAP NetWeaver AS ABAP and ABAP Platform Version(s) - KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 722EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 91.9 SAP NetWeaver AS ABAP and ABAP Platform Version(s) - SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 918, SAP_BASIS 919 SAP NetWeaver Application Server Java (Web Container) Version(s) - ENGINEAPI 7.50 [Recommended Action] Patch according to the solution released on the official website: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2026.html [References] 1. https://www.twcert.org.tw/tw/cp-169-10963-9280d-1.html
相關訊息	官方網站參考資料
公告時間	2026/6/15 至 2026/12/15	點閱次數	45