Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-27671

Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on the confidentiality, integrity, and availability of the application.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP NetWeaver AS ABAP and ABAP Platform

Default version status: unaffected

  • KRNL64NUC 7.22affected
  • 7.22EXTaffected
  • KRNL64UC 7.22affected
  • 722EXTaffected
  • 7.53affected
  • KERNEL 7.22affected
  • 7.54affected
  • 7.77affected
  • 7.89affected
  • 7.93affected
  • 9.16affected
  • 9.18affected
  • 91.9affected

References