by Kastro
Paper/Archive/CVE-2026-0509

CVE-2026-0509

SAP_SE SAP NetWeaver Application Server ABAP and ABAP Platform — Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform

EPSS 0.4%CVSS 9.6
critical.is priorityof 100
35
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 32.0.320 × 206.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no impact on the confidentiality of the application.

Affected

ProductAffectedFixed inSource
SAP NetWeaver Application Server ABAP and ABAP PlatformKRNL64NUC 7.22–CNA
SAP NetWeaver Application Server ABAP and ABAP Platform7.22EXT–CNA
SAP NetWeaver Application Server ABAP and ABAP PlatformKRNL64UC 7.22–CNA
SAP NetWeaver Application Server ABAP and ABAP Platform7.53–CNA
SAP NetWeaver Application Server ABAP and ABAP PlatformKERNEL 7.22–CNA
SAP NetWeaver Application Server ABAP and ABAP Platform7.54–CNA
SAP NetWeaver Application Server ABAP and ABAP Platform7.77–CNA
SAP NetWeaver Application Server ABAP and ABAP Platform7.89–CNA
SAP NetWeaver Application Server ABAP and ABAP Platform7.93–CNA
SAP NetWeaver Application Server ABAP and ABAP Platform9.16–CNA
SAP NetWeaver Application Server ABAP and ABAP Platform9.18–CNA
SAP NetWeaver Application Server ABAP and ABAP Platform9.19–CNA

Scores by source

sap (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refme.sap.com/notes/3674774refurl.sap/sapsecuritypatchday