CVE-2026-0509
critical · 9.6SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no impact on the confidentiality of the application.
9.6
CVSS
0.4%
EPSS (exploit prob.)
29th
EPSS percentile
2026-02-10
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Weaknesses
CWE-862
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| sap | netweaver_as_abap_kernel | 7.22 |
| sap | netweaver_as_abap_kernel | 7.53 |
| sap | netweaver_as_abap_kernel | 7.54 |
| sap | netweaver_as_abap_kernel | 7.77 |
| sap | netweaver_as_abap_kernel | 7.89 |
| sap | netweaver_as_abap_kernel | 7.93 |
| sap | netweaver_as_abap_kernel | 9.16 |
| sap | netweaver_as_abap_kernel | 9.18 |
| sap | netweaver_as_abap_kernel | 9.19 |
| sap | netweaver_as_abap_krnl64nuc | 7.22 |
| sap | netweaver_as_abap_krnl64nuc | 7.22ext |
| sap | netweaver_as_abap_krnl64uc | 7.22 |
| sap | netweaver_as_abap_krnl64uc | 7.22ext |
| sap | netweaver_as_abap_krnl64uc | 7.53 |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2026-0509