CVE-2026-27671CWE-121

Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform

Critical · published June 9, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on the confidentiality, integrity, and availability of the application.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00623 · 49.2th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2026-06-09T00:20Z
EPSS history
Timeline
  • 09 JUN 00:20Z
    Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
    cvelistv5