CVE-2026-27671

critical · 9.8

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on the confidentiality, integrity, and availability of the application.

9.8

CVSS

0.4%

EPSS (exploit prob.)

37th

EPSS percentile

2026-06-09

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-121

References

https://me.sap.com/notes/3717897
https://url.sap/sapsecuritypatchday

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-27671