What’s Vulnerable › Vulnerabilities

CVE-2021-27603

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-13 · updated 2026-06-17

Description

An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system.

Affected products

• SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform: 731, 740, 750

References

• https://launchpad.support.sap.com/#/notes/3028729
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649
• https://launchpad.support.sap.com/#/notes/3028729
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649

Get alerted when CVE-2021-27603 or the next vulnerability affects your stack