What’s Vulnerable › Vulnerabilities

CVE-2026-27689: Denial of service (DOS) in SAP Supply Chain Management

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-10 · updated 2026-06-17
• Weakness: CWE-606

Description

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.

Affected products

• SAP_SE SAP Supply Chain Management: SCMAPO 713, 714, S4CORE 102, 103, 104, S4COREOP 105 (+8)

References

• https://me.sap.com/notes/3719502
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-27689 or the next vulnerability affects your stack