{"id":"CVE-2026-23689","aliases":["EUVD-2026-6444","GHSA-g3pc-2885-cj35"],"status":"published","title":"Denial of service (DOS) in SAP Supply Chain Management","description":"Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00421,"percentile":0.36855,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-606","CWE-770"],"published":"2026-02-10T03:03:09Z","modified":"2026-06-17T10:21:57Z","products":[{"vendor":"sap","product":"advanced_planning_and_optimization"},{"vendor":"sap","product":"supply_chain_management"},{"vendor":"sap_se","product":"sap supply chain management"}],"references":[{"url":"https://me.sap.com/notes/3703092","tags":["Permissions Required"]},{"url":"https://url.sap/sapsecuritypatchday","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23689"},{"url":"https://github.com/advisories/GHSA-g3pc-2885-cj35"}],"sources":{"cve":[{"id":"CVE-2026-23689","title":"Denial of service (DOS) in SAP Supply Chain Management","description":"Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.","status":"published","published":"2026-02-10T03:03:09.536Z","modified":"2026-02-27T14:27:50.545Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-606"],"updated_at":"2026-11-02T13:42:04.39372Z"}],"euvd":[{"id":"EUVD-2026-6444","description":"Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.","status":"published","published":"2026-02-10T03:03:09Z","modified":"2026-02-27T14:27:50Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:14.049749Z"}],"ghsa":[{"id":"GHSA-g3pc-2885-cj35","title":"Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated...","description":"Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.","status":"published","published":"2026-02-10T06:30:38Z","modified":"2026-02-17T18:33:56Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-606","CWE-770"],"updated_at":"2026-11-02T15:06:14.396911Z"}],"nvd":[{"id":"CVE-2026-23689","description":"Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.","status":"published","published":"2026-02-10T04:16:03.5Z","modified":"2026-06-17T10:21:57.65Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-606","CWE-770"],"updated_at":"2026-11-02T14:12:05.52517Z"}]}}