CVE-2026-0506: sap_se sap netweaver application server abap and abap platform Missing Authorization

Vulnerability summary

CVE-2026-0506 is a high (CVSS 8.1) Missing Authorization vulnerability in sap_se sap netweaver application server abap and abap platform. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.3% of scored vulnerabilities.

Timeline

1. 13-01-2026
   PublishedVulnerability first disclosed.
2. 13-01-2026
   Last modifiedVulnerability information updated.

Description

Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs, resulting in a high impact on integrity and availability, while confidentiality remains unaffected.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.