TI-2021-04544 Aliases CVE-2021-21446 GHSA-jv2p-v76x-4c37

SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an…

LOW 36Published 2021-01-12 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, this has a high impact on the availability of the service.

Why it matters now

EPSS 0.01459 73rd percentileScored 2026-11-07

Fix Fixed SAP NetWeaver AS ABAP (SAP SE): 740, 750, 751 +4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SAP	SAP NetWeaver AS ABAP	before 740; before 750; before 751; before 752; before 753; before 754; before 755	740, 750, 751, 752, 753, 754, 755	Patch available	CNA

SAP NetWeaver AS ABAP VendorSAP Affected before 740; before 750; before 751; before 752; before 753; before 754; before 755 Fixed in 740, 750, 751, 752, 753, 754, 755 Patch available CNA

CPE configurations NVD · 7

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:netweaver_application_server_abap:740:::::::*	740	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:750:::::::*	750	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:751:::::::*	751	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:752:::::::*	752	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:753:::::::*	753	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:754:::::::*	754	Vulnerable	SAP
cpe:2.3:a:sap:netweaver_application_server_abap:755:::::::*	755	Vulnerable	SAP

cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP

Remediation

Fix · CNA SAP NetWeaver AS ABAP (SAP SE) Fixed in 740, 750, 751, 752, 753, 754, 755

Timeline

2026-10-02 Threatist record created from CVE-2021-21446
2026-10-03 Alias added: GHSA-jv2p-v76x-4c37

References

Advisory 1

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564760476

Other 1

https://launchpad.support.sap.com/#/notes/3000306

TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
TI-2023-21149 Missing Authorization check in SAP CommonCryptoLib CVSS 3.1CRITICAL 9.8
TI-2023-12229 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
TI-2023-12228 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8

See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences