CVE-2026-27671

9.8 criticalEPSS 0.4%

Critical (9.8). EPSS 0.4% chance of exploitation in the next 30 days.

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on the confidentiality, integrity, and availability of the application.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-121
Published: 2026-06-09
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

References

https://me.sap.com/notes/3717897
https://url.sap/sapsecuritypatchday

Check your stack JSON