Vulnerability details
CVE-2026-0509
SAP_SE SAP NetWeaver Application Server ABAP and ABAP Platform
Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform
CVSS 3.1
9.6Critical
Official description
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no impact on the confidentiality of the application.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.6Critical | 3.1 | CVEProject cvelistV5 (CNA) (sap) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | 7.22EXT | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | 7.53 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | 7.54 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | 7.77 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | 7.89 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | 7.93 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | 9.16 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | 9.18 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | 9.19 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | KERNEL 7.22 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | KRNL64NUC 7.22 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | KRNL64UC 7.22 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-02-10
- Last updated
- 2026-02-10
- State
- Published
- Assigner (CNA)
- sap
Exploit prediction (EPSS)
0.37%
Probability of exploitation in 30 days
31.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-862Missing Authorization