What’s Vulnerable › Vulnerabilities

CVE-2026-27688: Missing Authorization check in SAP NetWeaver Application Server for ABAP

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-10 · updated 2026-06-17
• Weakness: CWE-862

Description

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.

Affected products

• SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform: 700, 701, 702, 730, 731, 740 (+10)

References

• https://me.sap.com/notes/3704740
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-27688 or the next vulnerability affects your stack