{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27688", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-02-23T17:50:17.028Z", "datePublished": "2026-03-10T00:18:55.986Z", "dateUpdated": "2026-03-11T03:56:30.241Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-03-10T00:18:55.986Z"}, "title": "Missing Authorization check in SAP NetWeaver Application Server for ABAP", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP NetWeaver Application Server for ABAP", "versions": [{"status": "affected", "version": "SAP_BASIS 700"}, {"status": "affected", "version": "SAP_BASIS 701"}, {"status": "affected", "version": "SAP_BASIS 702"}, {"status": "affected", "version": "SAP_BASIS 710"}, {"status": "affected", "version": "SAP_BASIS 711"}, {"status": "affected", "version": "SAP_BASIS 730"}, {"status": "affected", "version": "SAP_BASIS 731"}, {"status": "affected", "version": "SAP_BASIS 740"}, {"status": "affected", "version": "SAP_BASIS 750"}, {"status": "affected", "version": "SAP_BASIS 751"}, {"status": "affected", "version": "SAP_BASIS 752"}, {"status": "affected", "version": "SAP_BASIS 753"}, {"status": "affected", "version": "SAP_BASIS 754"}, {"status": "affected", "version": "SAP_BASIS 755"}, {"status": "affected", "version": "SAP_BASIS 756"}, {"status": "affected", "version": "SAP_BASIS 757"}, {"status": "affected", "version": "SAP_BASIS 758"}, {"status": "affected", "version": "SAP_BASIS 816"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3704740"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-27688"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T03:56:30.241Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27688", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T15:35:55.299594Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T15:35:56.475Z"}}], "cna": {"title": "Missing Authorization check in SAP NetWeaver Application Server for ABAP", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP NetWeaver Application Server for ABAP", "versions": [{"status": "affected", "version": "SAP_BASIS 700"}, {"status": "affected", "version": "SAP_BASIS 701"}, {"status": "affected", "version": "SAP_BASIS 702"}, {"status": "affected", "version": "SAP_BASIS 710"}, {"status": "affected", "version": "SAP_BASIS 711"}, {"status": "affected", "version": "SAP_BASIS 730"}, {"status": "affected", "version": "SAP_BASIS 731"}, {"status": "affected", "version": "SAP_BASIS 740"}, {"status": "affected", "version": "SAP_BASIS 750"}, {"status": "affected", "version": "SAP_BASIS 751"}, {"status": "affected", "version": "SAP_BASIS 752"}, {"status": "affected", "version": "SAP_BASIS 753"}, {"status": "affected", "version": "SAP_BASIS 754"}, {"status": "affected", "version": "SAP_BASIS 755"}, {"status": "affected", "version": "SAP_BASIS 756"}, {"status": "affected", "version": "SAP_BASIS 757"}, {"status": "affected", "version": "SAP_BASIS 758"}, {"status": "affected", "version": "SAP_BASIS 816"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3704740"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.", "supportingMedia": [{"type": "text/html", "value": "<p>Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-03-10T00:18:55.986Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27688", "state": "PUBLISHED", "dateUpdated": "2026-03-10T16:52:36.446Z", "dateReserved": "2026-02-23T17:50:17.028Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-03-10T00:18:55.986Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected."}], "id": "CVE-2026-27688", "lastModified": "2026-03-11T13:53:47.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "cna@sap.com", "type": "Primary"}]}, "published": "2026-03-10T17:38:11.497", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3704740"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "cna@sap.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 700"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 701"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 702"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 710"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 711"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 730"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 731"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 740"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 750"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 751"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 752"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 753"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 754"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 755"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 756"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 757"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 758"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SAP_BASIS 816"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "SAP NetWeaver Application Server for ABAP", "source": "cna", "vendor": "SAP_SE"}, "product": "netweaver_application_server_for_abap", "vendor": "sap"}], "analysis": {"en": {"generated_at": "2026-04-16T09:54:06.664485+00:00", "value": {"mitigation_remediation": ["Apply the SAP security patch referenced in SAP Note\u202f3704740 to address the authorization check issue.", "Restrict or disable the specific RFC function module so that only authorized roles can execute it.", "Audit user roles to ensure that accounts do not possess unnecessary authorizations that could enable the exploit."], "summary": {"action": "Patch", "impact": "Confidentiality Exposure"}, "threat_synthesis": {"affected_systems": "The SAP NetWeaver Application Server for ABAP is affected. No specific product versions are listed in the advisory.", "description_and_impact": "An authenticated user can exploit a missing authorization check in SAP NetWeaver Application Server for ABAP to invoke a specific RFC function module and retrieve Database Analyzer Log Files. The logged data may contain sensitive information, and the attacker could potentially elevate privileges. The vulnerability does not affect system integrity or availability, but it allows limited disclosure of confidential information.", "risk_and_exploitability": "The vulnerability scores a CVSS of 5, indicating moderate risk, while the EPSS score of less than 1% suggests a very low likelihood of exploitation. It is not currently listed in CISA\u2019s KEV catalog. Attackers require valid user credentials and the ability to execute the RFC function module; no remote code execution or denial of service is possible."}}}}, "created": "2026-03-10T14:06:09.539157+00:00", "updated": "2026-04-16T10:00:14.079428+00:00", "vendors": ["sap", "sap$PRODUCT$netweaver_application_server_for_abap"]}