CVE-2026-0506

Published Jan 13, 2026

Last updated 2 months ago

Overview

Description
Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs, resulting in a high impact on integrity and availability, while confidentiality remains unaffected.
Source
cna@sap.com
NVD status
Analyzed
Products
netweaver_application_server_abap

Risk scores

CVSS 3.1

Type
Primary
Base score
8.1
Impact score
5.2
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Severity
HIGH

Weaknesses

cna@sap.com
CWE-862

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.