What is the CVSS score of CVE-2026-27689?

CVE-2026-27689 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-27689?

Within 24 hours: Inventory all systems running affected software and restrict network access to the vulnerable function module to trusted users/networks only. Within 7 days: Implement WAF rules or API gateway controls to detect and throttle requests with abnormally large loop parameters; enable detailed logging on affected modules. Within 30 days: Work with vendor for patch timeline; evaluate architectural alternatives or feature disablement if patches remain unavailable.

CVE-2026-27689

HIGH

Unchecked Input for Loop Condition (CWE-606)

2026-03-10 cna@sap.com

Denial Of Service

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 17:38 nvd

HIGH 7.7

DescriptionCVE.org

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.

AnalysisAI

Denial of service in a remote-enabled function module allows authenticated attackers to exhaust system resources by submitting requests with oversized loop parameters, rendering the affected system unavailable. The vulnerability requires valid user credentials and network access but no user interaction, making it exploitable by any authenticated user on the network. No patch is currently available to address this high-severity flaw.

Technical ContextAI

Affected ProductsAI

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network acce