Paper/Archive/CVE-2026-27671

CVE-2026-27671

SAP_SE SAP NetWeaver AS ABAP and ABAP Platform — Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 38.0.380 × 207.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on the confidentiality, integrity, and availability of the application.

Affected

ProductAffectedFixed inSource

SAP NetWeaver AS ABAP and ABAP PlatformKRNL64NUC 7.22–CNA

SAP NetWeaver AS ABAP and ABAP Platform7.22EXT–CNA

SAP NetWeaver AS ABAP and ABAP PlatformKRNL64UC 7.22–CNA

SAP NetWeaver AS ABAP and ABAP Platform722EXT–CNA

SAP NetWeaver AS ABAP and ABAP Platform7.53–CNA

SAP NetWeaver AS ABAP and ABAP PlatformKERNEL 7.22–CNA

SAP NetWeaver AS ABAP and ABAP Platform7.54–CNA

SAP NetWeaver AS ABAP and ABAP Platform7.77–CNA

SAP NetWeaver AS ABAP and ABAP Platform7.89–CNA

SAP NetWeaver AS ABAP and ABAP Platform7.93–CNA

SAP NetWeaver AS ABAP and ABAP Platform9.16–CNA

SAP NetWeaver AS ABAP and ABAP Platform9.18–CNA

Scores by source

sap (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refme.sap.com/notes/3717897 refurl.sap/sapsecuritypatchday