CVE-2021-27617: SAP NetWeaver Process Integration

Medium severity, CVSS 4.9. EPSS: 0.8% chance of exploitation in the next 30 days.

The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document uploaded from local source. An attacker can craft a malicious XML which when uploaded and parsed by the application, could lead to Denial-of-service conditions due to consumption of a large amount of system memory, thus highly impacting system availability.

Affected products

• SAP NetWeaver Process Integration: version 7.10 only; version 7.11 only; version 7.20 only; version 7.30 only; version 7.31 only; version 7.40 only; …

Published 2021-05-11. Last modified 2026-06-17.