What’s Vulnerable › Vulnerabilities
CVE-2026-0509: Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform
- Severity: critical (CVSS 9.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-10 · updated 2026-06-17
- Weakness: CWE-862
Description
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no impact on the confidentiality of the application.
Affected products
- SAP Netweaver As Abap Kernel: 7.22, 7.53, 7.54, 7.77, 7.89, 7.93 (+3)
- SAP Netweaver As Abap Krnl64Nuc: 7.22, 7.22ext
- SAP Netweaver As Abap Krnl64Uc: 7.22, 7.22ext, 7.53
References
Get alerted when CVE-2026-0509 or the next vulnerability affects your stack