What is the CVSS score of CVE-2026-0488?

CVE-2026-0488 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Netweaver Application Server Abap are affected by CVE-2026-0488?

A critical authorization bypass vulnerability (CVSS 9.9) affects SAP NetWeaver Application Server ABAP up to version 7.00, potentially allowing unauthorized users to access or manipulate sensitive…

How to fix or mitigate CVE-2026-0488?

Within 24 hours: Inventory all NetWeaver ABAP systems and identify those running version 7.00 or earlier; restrict network access to these systems to essential personnel only. Within 7 days: Implement network segmentation to isolate affected systems from untrusted networks; deploy WAF rules to block suspicious authorization-bypass attempts; enable enhanced logging and monitoring for authentication/authorization events. Within 30 days: Upgrade to NetWeaver ABAP version 7.50 or later; conduct full access reviews on affected systems to identify unauthorized access; perform forensic analysis for signs of exploitation.

Netweaver Application Server Abap CVE-2026-0488

CRITICAL

Missing Authorization (CWE-862)

2026-02-10 cna@sap.com

SAP Netweaver Application Server Abap Webclient Ui Framework

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 04:16 nvd

CRITICAL 9.9

DescriptionCVE.org

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

AnalysisAI

Unauthorized code execution in SAP CRM and SAP S/4HANA Scripting Editor. Authenticated attacker exploits generic function module call to execute unauthorized ABAP code. CVSS 9.9.

Technical ContextAI

CWE-862 missing authorization in the Scripting Editor's function module call. Authenticated users can execute ABAP code beyond their authorization.

RemediationAI

Apply SAP security note. Restrict access to Scripting Editor.

More in Netweaver Application Server Abap

View all

CVE-2020-26832 HIGH This Week POC

7.6 Dec 09

SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_

CVE-2021-33678 MEDIUM This Month POC

6.5 Jul 14

A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740

CVE-2021-21473 MEDIUM This Month POC

6.3 Jun 09

SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, con

CVE-2023-40309 CRITICAL Act Now

9.8 Sep 12

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization

CVE-2023-0014 CRITICAL Act Now

9.8 Jan 10

SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752,

CVE-2021-44231 CRITICAL Act Now

9.8 Dec 14

Internally used text extraction reports allow an attacker to inject code that can be executed by the application. Rated

CVE-2021-40499 CRITICAL Act Now

9.8 Oct 12

Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - vers

CVE-2021-27610 CRITICAL Act Now

9.8 Jun 16

SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does

CVE-2020-6275 CRITICAL Act Now

9.8 Jun 10

SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Serv

CVE-2023-27501 CRITICAL Act Now

9.6 Mar 14

SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757,

CVE-2023-27269 CRITICAL Act Now

9.6 Mar 14

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754,

CVE-2023-49581 CRITICAL Act Now

9.4 Dec 12

SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise b

Same weakness CWE-862 – Missing Authorization

View all

CVE-2023-52163 HIGH POC

8.8

CVE-2025-6205 CRITICAL POC

9.1

CVE-2017-9232 CRITICAL POC

9.8

CVE-2023-6875 CRITICAL POC

9.8

CVE-2024-4898 CRITICAL POC

9.8

CVE-2023-32117 CRITICAL POC

9.8

CVE-2025-20362 MEDIUM POC

6.5

CVE-2020-36719 CRITICAL POC

9.8

CVE-2026-0488 vulnerability details – vuln.today

Back

Netweaver Application Server Abap CVE-2026-0488

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Netweaver Application Server Abap

Same weakness CWE-862 – Missing Authorization

Share

External POC / Exploit Code