CVE-2026-27688: sap_se sap netweaver application server for abap Missing Authorization

Vulnerability summary

CVE-2026-27688 is a medium (CVSS 5.0) Missing Authorization vulnerability in sap_se sap netweaver application server for abap. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.5% of scored vulnerabilities.

Timeline

1. 10-03-2026
   PublishedVulnerability first disclosed.
2. 11-03-2026
   Last modifiedVulnerability information updated.

Description

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.