Advisory
A note with CVSS 4.3 for component BC-SRV-FP was released by SAP on 10.03.2026. The correction/advisory 3700960 was described with "3700960 - [Multiple CVEs] Denial of Service due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Services)" and affects the system type Java.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance.
The vulnerability addressed is denial of service (dos) within Java.
Denial of Service (DoS) attacks that take a system offline may lead to significant cost for the company, studies quantify the costs in average between 4 and 5 millions dollars. Business continuity requires SAP systems staying online. The CVSS scores or vulnerability descriptions are not enough to represent how a simple bug can lead to a significant loss for companies.
Risk specification
SAP NetWeaver AS Java (Adobe Document Services) allows an authenticated attacker to exploit known vulnerabilities in an outdated OpenSSL library, potentially resulting in crashes of ADS work processes and interruptions in document processing.
Solution
Adobe Document Services now includes the latest version of the OpenSSL library.
Affected System
SAP Netweaver Application Server Java is part of the SAP NetWeaver Application Platform. It provides the complete infrastructure for deploying and running Java applications.
- The AS Java Home: SAP Netweaver Application Server Java wiki
- A dedicated SAP NetWeaver 7.40 Application Server for Java Security Guide exists.
The advisory is valid for
