dbcve.org
Advanced Planning And OptimizationApplication · Sap

CVE-2026-23689

HIGH · 7.7 CVSS v3.1 Published 2026-02-10
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
83/100
Remediation priority · High
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

An authenticated attacker with regular user privileges can exploit a remote-enabled function module in what appears to be an SAP system by passing an excessively large loop-control parameter. This causes uncontrolled loop execution that consumes excessive CPU and memory resources, resulting in denial of service while confidentiality and integrity remain unaffected.

MitigationImplement strict input validation and parameter bounds checking on affected remote-enabled function modules; apply vendor security patches; consider implementing rate limiting or throttling for remote function calls.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Advanced Planning And OptimizationApplication
Affected:= 713= 714
Supply Chain ManagementApplication
Affected:= 700= 701= 702= 712

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify installed SAP product and version
    Execute transaction SM51 or use transaction code SE16 to query table CVERS. Check if the system is running SAP Advanced Planning and Optimization (APO) or SAP Supply Chain Management (SCM) and note the exact version number.
    Affected if The installed version matches 713 or 714 for APO, or 700, 701, 702, or 712 for SCM.
  2. Confirm remote function call (RFC) connectivity is enabled
    Use transaction SM59 to examine RFC destinations. Check if RFC connections of type '3' (R/3 connection) or 'G' (HTTP connection) are configured and active.
    Affected if RFC destinations are configured and the system accepts remote calls.
  3. Locate exposed remote-enabled function modules in APO/SCM
    Use transaction SE37 or SE80 to search for function modules with attribute 'Remote-Enabled' (check the Remote Module checkbox). Focus on modules in function groups related to APO or SCM components.
    Affected if Remote-enabled function modules exist in APO or SCM function pools.
  4. Audit user authorization for RFC function module execution
    Use transaction SUIM to query for users with authorization object S_RFC. Check which standard users or service accounts have RFC execute privileges.
    Affected if Regular (non-privileged) user accounts have RFC execution authorizations.

You are affected if your SAP system runs APO versions 713-714 or SCM versions 700-702/712, has RFC-enabled function modules exposed, and allows authenticated users to trigger remote function calls without strict parameter bounds checking.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Implement strict input validation and parameter bounds checking on affected remote-enabled function modules; apply vendor security patches; consider implementing rate limiting or throttling for remote function calls.

Fix this in Advanced Planning And Optimization Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing4.0 h
  • Review / QA2.0 h
18.0 hours of engineering $3,200
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-23689 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-23689 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data