CVE-2026-27688: SAP NetWeaver Application Server Abap

Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days.

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.

Affected products

• SAP NetWeaver Application Server Abap: version 700 only; version 701 only; version 702 only; version 730 only; version 731 only; version 740 only; …

Published 2026-03-10. Last modified 2026-06-17.