SAP Gateway (SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64…
Priority LOW 35Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
SAP Gateway (SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.53) allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
Why it matters now
EPSS 0.01085 65th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP Gateway | SAP KERNEL 32 NUC 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 32 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 64 NUC 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.53 | — | No fix listed | CNA |
- SAP Gateway VendorSAP Affected SAP KERNEL 32 NUC 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 32 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 64 NUC 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.53 Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:sap_kernel:7.21:*:*:*:*:*:*:* | 7.21 | Vulnerable | SAP |
| cpe:2.3:a:sap:sap_kernel:7.21ext:*:*:*:*:*:*:* | 7.21ext | Vulnerable | SAP |
| cpe:2.3:a:sap:sap_kernel:7.22:*:*:*:*:*:*:* | 7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:sap_kernel:7.22ext:*:*:*:*:*:*:* | 7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:sap_kernel:7.45:*:*:*:*:*:*:* | 7.45 | Vulnerable | SAP |
| cpe:2.3:a:sap:sap_kernel:7.49:*:*:*:*:*:*:* | 7.49 | Vulnerable | SAP |
| cpe:2.3:o:sap:sap_kernel:7.53:*:*:*:*:*:*:* | 7.53 | Vulnerable | SAP |
- cpe:2.3:a:sap:sap_kernel:7.21:*:*:*:*:*:*:* Versions 7.21 Vulnerable ·SAP
- cpe:2.3:a:sap:sap_kernel:7.21ext:*:*:*:*:*:*:* Versions 7.21ext Vulnerable ·SAP
- cpe:2.3:a:sap:sap_kernel:7.22:*:*:*:*:*:*:* Versions 7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:sap_kernel:7.22ext:*:*:*:*:*:*:* Versions 7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:sap_kernel:7.45:*:*:*:*:*:*:* Versions 7.45 Vulnerable ·SAP
- cpe:2.3:a:sap:sap_kernel:7.49:*:*:*:*:*:*:* Versions 7.49 Vulnerable ·SAP
- cpe:2.3:o:sap:sap_kernel:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-2433
- 2026-10-03 Alias added: GHSA-wv65-jfgx-wm66
References
More Sap Kernel vulnerabilities
- TI-2017-12277 Improper authentication in SAP Trusted RFC connection CVSS 3.0HIGH 8.8
- TI-2018-01748 Missing authentication in SAP Startup Service CVSS 3.0HIGH 7.5
- TI-2019-00299 SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22… CVSS 3.1HIGH 7.5
- TI-2017-03910 The SAP Message Server HTTP daemon in SAP KERNEL 7.21-7.49 allows remote attackers to… CVSS 3.0HIGH 7.5
- TI-2014-07786 Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit… CVSS 2.0MEDIUM 6.5
- TI-2014-07785 Buffer overflow in the SAP NetWeaver Dispatcher in SAP Kernel 7.00 32-bit and 7.40 64-bit… CVSS 2.0MEDIUM 6.5
Sources
- CVE-2018-2433 · CVE Program
- CVE-2018-2433 · NVD
- FIRST EPSS
- GHSA-wv65-jfgx-wm66 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences