CVE-2023-24526: SAP NetWeaver Application Server Java

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user identity, resulting in escalation of privileges. This failure has a low impact on confidentiality of the data such that an unassigned user can read non-sensitive server data.

Affected products

• SAP NetWeaver Application Server Java: version 7.50 only

Published 2023-03-14. Last modified 2026-06-17.