Skip to main content

Netweaver Application Server Abap CVE-2026-0488

CRITICAL
Missing Authorization (CWE-862)
2026-02-10 cna@sap.com
SAP Netweaver Application Server Abap Webclient Ui Framework
9.9
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate to SAP CRM/S/4HANA
  2. Delivery
    Access Scripting Editor interface
  3. Exploit
    Craft malicious generic function module call
  4. Execution
    Execute arbitrary SQL statements
  5. Impact
    Compromise database integrity and confidentiality

Vulnerability Assessment

Weakness
CWE
CWE-862
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Authenticated user account with access to Scripting Editor in SAP CRM or SAP S/4HANA. No additional special configuration required beyond standard Scripting Editor functionality being enabled.
Impact

CVSS 9.9. SAP ERP systems contain the most sensitive business data — unauthorized code execution affects financials, HR, and supply chain.
Exploit ScenarioDerived

Low-privileged SAP user exploits the Scripting Editor to call arbitrary ABAP function modules, accessing data and operations beyond their role.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Unauthorized code execution in SAP CRM and SAP S/4HANA Scripting Editor. Authenticated attacker exploits generic function module call to execute unauthorized ABAP code. CVSS 9.9.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 22:02 CVSS 9.9

Unauthorized ABAP code execution in SAP CRM/S4HANA.

RemediationAI

Apply SAP security note. Restrict access to Scripting Editor.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

CWE-862 missing authorization in the Scripting Editor's function module call. Authenticated users can execute ABAP code beyond their authorization.

Know when Netweaver Application Server Abap gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.9 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

Executive ViewAI

Why It Matters

A critical authorization bypass vulnerability (CVSS 9.9) affects SAP NetWeaver Application Server ABAP up to version 7.00, potentially allowing unauthorized users to access or manipulate sensitive business data without proper credentials. Organizations running affected versions face immediate risk of data breach, fraudulent transactions, and regulatory compliance violations until remediation is completed.

Business Impact: Severe
Compensating Controls

Implement strict network segmentation and firewall rules limiting access to affected systems; deploy Web Application Firewall (WAF) with rules monitoring for authorization bypass patterns; enable comprehensive audit logging for all user actions on affected systems; enforce multi-factor authentication for all access to NetWeaver ABAP systems; disable unnecessary features and services on affected instances; conduct daily access reviews and anomaly detection; consider temporary read-only mode if operationally feasible; establish incident response procedures specific to unauthorized data access scenarios.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Very High

Priority Score

50
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +50
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Affected Products (CPE)CVE.org

cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:102:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:103:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:104:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:105:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:106:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:107:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:108:*:*:*:*:*:*:*
cpe:2.3:a:sap:s\/4hana:109:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:700:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:701:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:730:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:731:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:746:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:747:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:748:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:800:*:*:*:*:*:*:*
cpe:2.3:a:sap:webclient_ui_framework:801:*:*:*:*:*:*:*

More in Netweaver Application Server Abap

View all
CVE-2020-26832 HIGH POC
7.6 Dec 09

SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_
CVE-2021-33678 MEDIUM POC
6.5 Jul 14

A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740
CVE-2021-21473 MEDIUM POC
6.3 Jun 09

SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, con
CVE-2023-40309 CRITICAL
9.8 Sep 12

SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization
CVE-2023-0014 CRITICAL
9.8 Jan 10

SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752,

CVE-2021-44231 CRITICAL
9.8 Dec 14

Internally used text extraction reports allow an attacker to inject code that can be executed by the application. Rated

CVE-2021-40499 CRITICAL
9.8 Oct 12

Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - vers
CVE-2021-27610 CRITICAL
9.8 Jun 16

SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does
CVE-2020-6275 CRITICAL
9.8 Jun 10

SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Serv
CVE-2023-27501 CRITICAL
9.6 Mar 14

SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757,

CVE-2023-27269 CRITICAL
9.6 Mar 14

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754,
CVE-2023-49581 CRITICAL
9.4 Dec 12

SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise b

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://url.sap/sapsecuritypatchday REF https://me.sap.com/notes/3697099

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy