SAP NetWeaver As Abap KRNL64UC vulnerabilities

5 CVEs affecting SAP NetWeaver As Abap KRNL64UC, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-24320, published 2026-02-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-27668, published 2022-06-14. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and…
CVE-2022-29616, published 2022-05-11. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. SAP Host Agent, SAP NetWeaver and ABAP Platform allow an attacker to leverage logical errors in memory management to cause a memory corruption.
CVE-2022-27656, published 2022-05-11. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVE-2026-0509, published 2026-02-10. Critical severity, CVSS 9.6. EPSS: 0.4% chance of exploitation in the next 30 days. SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain…
CVE-2026-24320, published 2026-02-10. Low severity, CVSS 3.1. EPSS: 0.3% chance of exploitation in the next 30 days. Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially…