EUVD-2026-55873
GHSA-cwxf-3c8c-3p26
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable ADT interface requires only a low-privilege SAP login; no user interaction or elevated role needed; full C/I/A impact on the ABAP system confirmed by description.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.
AnalysisAI
Missing authorization checks in SAP ABAP Developer Tools (the Eclipse-based IDE for ABAP development) allow any low-privileged SAP user to execute unauthorized database operations against SAP NetWeaver AS ABAP backends. The flaw spans a wide range of SAP_BASIS releases (750 through 920) and yields full confidentiality, integrity, and availability compromise of the ABAP application layer - including the ability to read sensitive business data, modify application records, and disrupt legitimate user access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, low-privilege SAP account (PR:L as confirmed by the CVSS vector) and network-level access to the target SAP NetWeaver AS ABAP instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 (High) is supported by a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: the vulnerability is reachable over the network with low attack complexity, requires only a standard (low-privilege) SAP login, and yields full impact across all three security pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply SAP Security Note 3772411, available through the SAP Support Portal at https://me.sap.com/notes/3772411 and referenced via the SAP Security Patch Day page at https://url.sap/sapsecuritypatchday. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all SAP environments running ABAP Developer Tools (versions 750-920) connected to NetWeaver AS ABAP backends and restrict ADT connectivity to non-production systems only; immediately enforce principle of least privilege for all ADT user accounts and audit current database operation permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today