What is the CVSS score of EUVD-2026-35278?

EUVD-2026-35278 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of SAP NetWeaver are affected by EUVD-2026-35278?

SAP NetWeaver Application Server, which hosts critical enterprise resource planning processes, contains a critical vulnerability (CVE-2026-27671, CVSS 9.8) allowing remote attackers to compromise…

How to fix or mitigate EUVD-2026-35278?

Within 24 hours: Inventory all SAP NetWeaver Application Server ABAP and ABAP Platform deployments, document current versions and patch levels, and identify external RFC connectivity. Within 7 days: Review SAP security bulletin for interim guidance, implement network-level restrictions on RFC ports (typically TCP 3200-3299), and assess critical service dependencies. Within 30 days: Establish emergency change procedures for out-of-cycle patching upon vendor release; engage SAP enterprise support for technical workarounds; prioritize patch deployment above standard change windows.

SAP NetWeaver EUVD-2026-35278

| CVE-2026-27671 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-06-09 cna@sap.com

GHSA-rvg2-xqmh-v3qw

SAP Stack Overflow Buffer Overflow

9.8

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (sap) · only source for this CVE.

CVSS VectorVendor: sap

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 01:30 vuln.today

CVE Published

Jun 09, 2026 - 01:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on the confidentiality, integrity, and availability of the application.

Articles & Coverage 2

News 3 Critical SAP Vulnerabilities Disclosed - No Public Exploits Yet Jun 10, 2026 News Critical RCE via Memory Corruption in SAP NetWeaver ABAP Kernel - CVE-2026-27671 Jun 09, 2026

AnalysisAI

Unauthenticated remote memory corruption in the SAP Kernel of SAP NetWeaver Application Server ABAP and ABAP Platform allows attackers to compromise confidentiality, integrity, and availability by sending crafted RFC requests that trigger logical errors in memory management. The CVSS 9.8 score reflects network-reachable, no-privileges, no-interaction exploitation against a foundational SAP component, though no public exploit identified at time of analysis and exploitation status beyond the vendor disclosure is not confirmed in CISA KEV.

Technical ContextAI

The vulnerability resides in the SAP Kernel, the C/C++ runtime that underpins the ABAP Application Server (AS ABAP) and the broader ABAP Platform used across S/4HANA, ECC, BW, and Solution Manager deployments. The defect is in handling of the Remote Function Call (RFC) protocol - SAP's proprietary RPC mechanism (typically TCP/33xx and gateway 33xx/48xx) used for system-to-system and client integration. CWE-121 (Stack-based Buffer Overflow), combined with the 'Buffer Overflow / Stack Overflow' tags, indicates the underlying RFC parsing routine fails to enforce RFC protocol field length or structural constraints, allowing crafted input to corrupt the stack frame of the receiving kernel process (typically disp+work or gwrd).

RemediationAI

Apply the patch available per vendor advisory by installing the SAP Kernel patch referenced in SAP Note 3717897 (https://me.sap.com/notes/3717897), reviewing the SAP Security Patch Day bulletin at https://url.sap/sapsecuritypatchday for the exact kernel patch level applicable to each release line - exact fix versions were not included in the input data and must be confirmed against the SAP Note. Until the kernel can be patched, restrict network reachability of the SAP gateway and dispatcher ports (typically 3300-3399 and 4800-4899) to only known application servers and trusted RFC partners via firewall ACLs and the gateway's secinfo/reginfo access control lists, accepting the trade-off that overly tight reginfo entries can break legitimate RFC integrations and registered programs. Enabling SNC (Secure Network Communications) on RFC channels raises the bar by requiring authenticated peers but does not by itself eliminate parser-level memory corruption against authenticated traffic, and disabling RFC entirely is generally not viable in production SAP landscapes.