CVE-2026-24309: sap_se sap netweaver application server for abap Missing Authorization

Vulnerability summary

CVE-2026-24309 is a medium (CVSS 6.4) Missing Authorization vulnerability in sap_se sap netweaver application server for abap. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.4% of scored vulnerabilities.

Timeline

1. 10-03-2026
   PublishedVulnerability first disclosed.
2. 10-03-2026
   Last modifiedVulnerability information updated.

Description

Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify or insert entries into the database configuration table of the ABAP system. This unauthorized content change could lead to reduced system performance or interruptions. The vulnerability has low impact on the application's integrity and availability, with no effect on confidentiality.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.