Missing Authorization check in SAP NetWeaver Application Server for ABAP (SAP_SE SAP NetWeaver Application Server for ABAP)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.21 % · percentile 12 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Analyzed
Description
Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify or insert entries into the database configuration table of the ABAP system. This unauthorized content change could lead to reduced system performance or interruptions. The vulnerability has low impact on the application's integrity and availability, with no effect on confidentiality.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L | sap |
| CVSS 3.1 | MEDIUM 6.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-10443
- GCVE · GCVE-0-2026-24309
CERT-FR advisories
- CERTFR-2026-AVI-0256 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:757:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:758:*:*:*:sap_basis:*:*:*cpe:2.3:a:sap:netweaver_application_server_abap:816:*:*:*:sap_basis:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP NetWeaver Application Server for ABAP | affected SAP_BASIS 700 ; affected SAP_BASIS 701 ; affected SAP_BASIS 702 ; affected SAP_BASIS 731 ; affected SAP_BASIS 740 ; affected SAP_BASIS 750 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |