What’s Vulnerable › Vulnerabilities
CVE-2025-26661: Missing Authorization check in SAP NetWeaver (ABAP Class Builder)
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-11 · updated 2026-06-17
- Weakness: CWE-862
Description
Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high impact on the integrity and availability of the application.
Affected products
- SAP_SE SAP NetWeaver (ABAP Class Builder): SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750 (+9)
References
Get alerted when CVE-2025-26661 or the next vulnerability affects your stack