CVE-2023-36926— Information disclosure vulnerability in SAP Host Agent
Quick assessment
Affected
SAP_SE SAP Host Agent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP Host Agent是德国思爱普（SAP）公司的一套支持操作系统监视、数据库监视和系统实例监视等多项生命周期管理任务的代理程序。 SAP Host Agent 存在授权问题漏洞，该漏洞源于缺少身份验证检查，未经身份验证的攻击者可以将未记录的参数设置为特定的兼容性值，然后调用读取函数。
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-36926
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Information disclosure vulnerability in SAP Host Agent
Source: CVE Program / CVE List V5
Vulnerability Description
Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibility value and in turn call read functions. This allows the attacker to gather some non-sensitive information about the server. There is no impact on integrity or availability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Host Agent 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Host Agent是德国思爱普（SAP）公司的一套支持操作系统监视、数据库监视和系统实例监视等多项生命周期管理任务的代理程序。 SAP Host Agent 存在授权问题漏洞，该漏洞源于缺少身份验证检查，未经身份验证的攻击者可以将未记录的参数设置为特定的兼容性值，然后调用读取函数。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Host Agent | 7.22 | - |
|
II. Public POCs for CVE-2023-36926
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-36926
请登录查看更多情报信息。
Other References for CVE-2023-36926 (2)
Same Patch Batch · SAP_SE · 2023-08-08 · 15 CVEs total
| CVE-2023-37483 | 9.8 CRITICAL | Improper Access Control Vulnerabilities in SAP PowerDesigner |
| CVE-2023-39439 | 8.8 HIGH | SAP Commerce accepts empty passphrases. |
| CVE-2023-36923 | 7.8 HIGH | Code Injection vulnerability in SAP PowerDesigner |
| CVE-2023-39437 | 7.6 HIGH | Cross-Site Scripting (XSS) vulnerability in SAP Business One |
| CVE-2023-37490 | 7.6 HIGH | Binary hijack in SAP BusinessObjects Business Intelligence (Installer) |
| CVE-2023-37491 | 7.5 HIGH | Improper Authorization check vulnerability in SAP Message Server |
| CVE-2023-33993 | 7.1 HIGH | SQL Injection vulnerability in SAP Business One B1i Layer |
| CVE-2023-37488 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration |
| CVE-2023-37486 | 5.9 MEDIUM | Information Disclosure vulnerability in SAP Commerce (OCC API) |
| CVE-2023-39436 | 5.8 MEDIUM | Information Disclosure in SAP Supplier Relationship Management |
| CVE-2023-37487 | 5.3 MEDIUM | Security misconfiguration vulnerability in SAP Business One (Service Layer) |
| CVE-2023-37484 | 5.3 MEDIUM | Information Disclosure Vulnerabilities in SAP PowerDesigner |
| CVE-2023-37492 | 4.9 MEDIUM | Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform |
| CVE-2023-39440 | 4.4 MEDIUM | Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-306
-
CVE-2026-105049
Zilliz Attu<3.0.0 Playground未授权访问漏洞 -
CVE-2026-95102
Monta monta.app Missing Authentication for Critical Function -
CVE-2026-82042
UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyF -
CVE-2026-103956
Missing authentication for critical function in Loom for AWS -
CVE-2026-104446
YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Con
V. Comments for CVE-2023-36926
No comments yet