EUVD-2026-55868
GHSA-9gvf-fp5r-4gqr
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
PR:H confirmed by description requiring high privileges; A:H reflects ability to halt the SAP system; C:N as no confidentiality impact is described.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.
AnalysisAI
OS command injection in SAP NetWeaver Application Server ABAP and ABAP Platform enables an attacker holding high-privilege credentials to bypass missing security controls on an internal ABAP code path and execute arbitrary commands on the underlying operating system. Affected releases span kernel versions 7.22 through 9.16, placing a broad range of production SAP landscapes at risk of service disruption or unauthorized OS-level writes. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high availability impact (A:H) makes it a meaningful patch priority for SAP Basis teams.
Technical ContextAI
The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements Used in an OS Command - OS Command Injection), indicating that attacker-controlled input reaches an OS-level execution point without adequate sanitization or authorization enforcement. The affected component is the SAP NetWeaver Application Server ABAP runtime and ABAP Platform, identified by CPE cpe:2.3:a:sap_se:sap_netweaver_application_server_abap_and_abap_platform:*:*:*:*:*:*:*:*. The flaw exists on an internal code path within the ABAP kernel layer - the specific transaction, function module, or RFC interface is not disclosed in available data - where a security control designed to prevent OS interaction is absent or insufficiently enforced, allowing crafted ABAP-level input to pass through to OS-level execution. The wildcard CPE version field confirms the issue spans multiple kernel variants including KRNL64UC, KRNL64NUC, and standard KERNEL builds.
RemediationAI
Apply the fix detailed in SAP Security Note 3745182, available at https://me.sap.com/notes/3745182 via the SAP Support Portal; this note was released as part of SAP's regular Security Patch Day cycle, details of which are published at https://url.sap/sapsecuritypatchday. The exact corrected kernel patch level or Support Package number is not independently confirmed from the provided data and must be obtained directly from the note. As a compensating control pending patch deployment, restrict assignment of high-privilege profiles (such as SAP_ALL or any profile granting authorization to the relevant basis objects) strictly to essential accounts, removing access from service or batch accounts where not operationally required - note that over-restriction of basis authorizations can break administrative workflows and must be coordinated with SAP Basis teams. Additionally, enable and review SAP Security Audit Log (SM19/RSAU_CONFIG) for anomalous OS-command-class events, which can provide detection capability even if it does not prevent exploitation. Network-level controls limiting SAP system port exposure to trusted administrative networks reduce attack surface by preventing remote exploitation from non-privileged network segments.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today