5

CVE-2026-27688

Missing Authorization check in SAP NetWeaver Application Server for ABAP

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
SAP ≫ Netweaver Application Server Abap Version 700 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 701 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 702 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 730 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 731 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 740 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 750 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 751 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 752 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 753 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 754 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 755 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 756 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 757 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 758 SwEdition sap_basis
SAP ≫ Netweaver Application Server Abap Version 816 SwEdition sap_basis
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.135
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
SAP 5 3.1 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://url.sap/sapsecuritypatchday
Vendor Advisory
https://me.sap.com/notes/3704740
Permissions Required