CVE-2023-40309
CWE-863Published: September 12, 2023· Updated: Jun 17, 2026
Official Description
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired, an attacker could abuse functionality restricted to a particular user group as well as read, modify or delete restricted data.
Risk Analysis
SAP CommonCryptoLib fails to perform necessary authentication checks, leading to potential privilege escalation and unauthorized data access. This critical vulnerability is rated 9.8 on the CVSS scale.
There is no known public exploit, and it is not in the CISA KEV. The vulnerability is remotely exploitable with low complexity.
Update the affected SAP components to the latest versions. Ensure that proper authorization checks are configured across all integrated services.
Technical Analysis
CVE-2023-40309 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (4)
Quick Facts
Related CVEs (CWE-863)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2023-40309 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts