EUVD-2026-72583
GHSA-79h6-mww5-hcf3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege SAP credentials
-
DeliveryAuthenticate to AS ABAP over network
-
ExploitCall configuration-reading function module or endpoint
-
ExecutionMissing authority-check bypassed silently
-
PersistRetrieve security-relevant system configuration
-
ImpactUse config data for targeted reconnaissance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid, authenticated SAP session with at least a low-privilege dialog or RFC user account on the targeted system - PR:L per the CVSS vector. No special non-default configuration is needed beyond having a working SAP logon. The vulnerability is reachable over the network (AV:N) without user interaction (UI:N). What limits exploitation: the attacker must possess a valid SAP credential (eliminating entirely unauthenticated internet actors); impact is read-only and restricted to configuration metadata (C:L), not business data or credentials directly; and integrity and availability are unaffected. Organizations with strong identity governance and minimal standing SAP accounts face materially lower risk. |
| Impact | CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately reflects the limited real-world impact: network-reachable, low complexity, but requiring a valid low-privileged SAP account and yielding only a low confidentiality impact. No EPSS score, KEV listing, or POC code is available in the provided data, so there is no signal of active or imminent exploitation. The principal risk in practice is that leaked security-relevant configuration details (e.g., RFC gateway settings, security profile parameters, or trust relationships) could serve as reconnaissance data to inform a follow-on attack requiring higher privileges. The 'Authentication Bypass' tag applied in the source data is incorrect - this is a missing authorization check on an already-authenticated user, not a bypass of authentication itself; this mislabeling should be corrected to avoid triage confusion. Overall priority is low-to-medium: apply on the next regular SAP patch cycle rather than emergency patching. |
| Exploit ScenarioDerived | An attacker with a low-privileged SAP dialog user account (e.g., a regular business user or a service account obtained through credential phishing) sends a crafted RFC or HTTP request to a configuration-reading function module in the Application Server ABAP. Because the authorization check is missing, the system returns security-relevant configuration parameters - such as login/security profile settings or gateway trust entries - without enforcing the required basis-admin role. The attacker uses this information to map internal security controls and plan a privilege-escalation attempt. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Unauthorized configuration data disclosure in SAP NetWeaver and ABAP Platform allows authenticated network attackers to read sensitive system configuration and security-relevant settings without holding the required authorization. The flaw stems from a missing authorization check (CWE-862) in the Application Server ABAP component, meaning any low-privileged authenticated user can query configuration details that should be restricted to privileged roles. Impact is confined to confidentiality at a low level; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the correction delivered via SAP Security Note 3772838, available through the SAP Support Portal at https://me.sap.com/notes/3772838. The exact patched support-package or kernel level is not independently confirmed from the data provided - consult the note directly for the precise baseline. As a compensating control prior to patching, restrict SAP system access to only trusted user accounts by auditing and tightening the user role assignments in transaction SU01/PFCG, ensuring that generic dialog or batch users do not hold unnecessary authorizations. Additionally, restricting network-layer access to the ABAP application server ports (typically 32xx/33xx/44xx) to authorized subnets reduces the pool of potential attackers. These controls do not eliminate the vulnerability but raise the effective bar for exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SAP NetWeaver Application Server ABAP is the runtime layer for ABAP-based SAP applications, including S/4HANA and classic ECC. The affected component exposes system configuration endpoints that are intended to be accessible only to privileged roles (e.g., basis administrators). CWE-862 (Missing Authorization) indicates the code reaches the sensitive data retrieval logic without performing a proper authorization object check - a common ABAP pattern where authority-check statements are omitted or bypassed before accessing configuration tables or RFC-callable function modules. The CPE cpe:2.3:a:sap_se:sap_netweaver_and_abap_platform:*:*:*:*:*:*:*:* covers all versioned releases without a pinned upper bound, suggesting the flaw is present across a broad release range.
Know when Sap Netweaver And Abap Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable with low-privilege auth required; only configuration metadata exposed, so C:L with no integrity or availability impact.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
DescriptionCVE.org
Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB