This vulnerability (CVE-2026-40135) involves improper neutralization of special elements used in OS commands (CWE-77) within SAP NetWeaver Application Server for ABAP and ABAP Platform. An attacker with administrative access can inject and execute unintended OS shell commands on the server, bypassing logging mechanisms. This affects a wide range of SAP_BASIS versions (700 to 816). The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact. No vendor patch or remediation level is currently documented, and the product is not a cloud service.

Successful exploitation allows an authenticated administrator to execute arbitrary OS commands on the affected SAP server without detection due to logging bypass. This can compromise the integrity and availability of the application environment. Confidentiality is not impacted. The vulnerability affects multiple SAP_BASIS versions, potentially impacting many SAP customers running these versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is documented, organizations should monitor SAP security advisories closely for updates. Until a patch is available, restrict administrative access to trusted personnel only and consider additional monitoring of command execution and system integrity where possible. No vendor advisory indicates that the issue is already mitigated or requires no action.