CVE-2021-27610

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-16 · updated 2026-06-17
Weakness: CWE-287

Description

SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal and external RFC user in consistent and distinguished format, which could lead to improper authentication and may be exploited by malicious users to obtain illegitimate access to the system.

Affected products

SAP SE SAP NetWeaver AS for ABAP (RFC Gateway): 700, 701, 702, 731, 740, 750 (+6)
SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform: 700, 701, 702, 731, 740, 750 (+6)

References

https://launchpad.support.sap.com/#/notes/3007182
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999
https://launchpad.support.sap.com/#/notes/3007182
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999

Get alerted when CVE-2021-27610 or the next vulnerability affects your stack