PT-2026-2340 · Sap · Abap Platform+1

Published 2026-01-13 · Updated 2026-02-09 · CVE-2026-0506

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Application Server ABAP and ABAP Platform (affected versions not specified)

Description A missing authorization check exists in Application Server ABAP and ABAP Platform. An authenticated attacker can misuse an RFC function to execute form routines (FORMs) within the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs. This could lead to a high impact on data integrity and system availability. The vulnerable component is an RFC function. The affected functionality involves the execution of FORMs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-0506

Affected Products

Abap Platform

Abap Application Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-0506 · Security Note
• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-0506 · Vendor Advisory
• https://me.sap.com/notes/3688703 · Note
• https://twitter.com/DavidMarquet19/status/2020769785152196822 · Twitter Post
• https://twitter.com/CVEnew/status/2010911098992578906 · Twitter Post