CVE-2026-40135 — Command Injection

title: SAP NetWeaver Command Injection via ABAP Platform — CVE-2026-40135
id: scw-2026-05-12-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2026-40135 by targeting the SAP NetWeaver Application Server for ABAP and ABAP Platform. This rule looks for specific URI patterns associated with the vulnerable 'appl_log_display' application, which is a known entry point for command injection in this CVE. The attacker, with administrative privileges, can craft shell commands to be executed on the server, bypassing logging mechanisms.
author: SCW Feed Engine (AI-generated)
date: 2026-05-12
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-40135/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/sap/bc/webdynpro/sap/appl_log_display'
      cs-uri-query|contains:
          - 'sap-language=EN&sap-client=' # Example of common parameters that might precede the injection
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse