PT-2026-24164 · Sap · Sap Netweaver Application Server Abap

Published 2026-03-10 · Updated 2026-03-10 · CVE-2026-27688

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for ABAP (affected versions not specified)

Description An authenticated attacker with user privileges may be able to read Database Analyzer Log Files due to a missing authorization check within a specific RFC function module. An attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read sensitive data, impacting the confidentiality of the information stored. The integrity and availability of the system are not affected. The vulnerable component is an RFC function module.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-27688

Affected Products

Sap Netweaver Application Server Abap

References · 5

• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27688 · Security Note
• https://me.sap.com/notes/3704740 · Note
• https://twitter.com/CVEnew/status/2031294581673963766 · Twitter Post
• https://t.me/CVEtracker/46970 · Telegram Post