Out-of-bounds read in SAP NetWeaver ABAP Server and ABAP Platform
Priority LOW 36CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.
Summary
SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EncOAMParamStore() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.
Why it matters now
EPSS 0.01508 74th percentileScored 2026-11-07
Fix Fixed SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server) (SAP SE): 7.22EXT, 7.49, 7.22 +3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server) | < KRNL32NUC - 7.22; before 7.22EXT; < KRNL64NUC - 7.22; before 7.49; < KRNL64UC - 8.04; before 7.22; before 7.53; before 7.73; < KERNEL - 7.22; before 8.04 | 7.22EXT, 7.49, 7.22, 7.53, 7.73, 8.04 | Patch available | CNA |
- SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server) VendorSAP Affected < KRNL32NUC - 7.22; before 7.22EXT; < KRNL64NUC - 7.22; before 7.49; < KRNL64UC - 8.04; before 7.22; before 7.53; before 7.73; < KERNEL - 7.22; before 8.04 Fixed in 7.22EXT, 7.49, 7.22, 7.53, 7.73, 8.04 Patch available CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_as_abap:kernel_7.22:*:*:*:*:*:*:* | kernel_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:kernel_7.49:*:*:*:*:*:*:* | kernel_7.49 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:kernel_7.53:*:*:*:*:*:*:* | kernel_7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:kernel_7.73:*:*:*:*:*:*:* | kernel_7.73 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:kernel_7.77:*:*:*:*:*:*:* | kernel_7.77 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:kernel_7.81:*:*:*:*:*:*:* | kernel_7.81 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:kernel_7.82:*:*:*:*:*:*:* | kernel_7.82 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:kernel_7.83:*:*:*:*:*:*:* | kernel_7.83 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:kernel_8.04:*:*:*:*:*:*:* | kernel_8.04 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:krnl32nuc_7.22:*:*:*:*:*:*:* | krnl32nuc_7.22 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_as_abap:kernel_7.22:*:*:*:*:*:*:* Versions kernel_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:kernel_7.49:*:*:*:*:*:*:* Versions kernel_7.49 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:kernel_7.53:*:*:*:*:*:*:* Versions kernel_7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:kernel_7.73:*:*:*:*:*:*:* Versions kernel_7.73 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:kernel_7.77:*:*:*:*:*:*:* Versions kernel_7.77 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:kernel_7.81:*:*:*:*:*:*:* Versions kernel_7.81 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:kernel_7.82:*:*:*:*:*:*:* Versions kernel_7.82 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:kernel_7.83:*:*:*:*:*:*:* Versions kernel_7.83 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:kernel_8.04:*:*:*:*:*:*:* Versions kernel_8.04 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:krnl32nuc_7.22:*:*:*:*:*:*:* Versions krnl32nuc_7.22 Vulnerable ·SAP
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_as_abap:krnl32nuc_7.22ext:*:*:*:*:*:*:* | krnl32nuc_7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22:*:*:*:*:*:*:* | krnl64nuc_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:* | krnl64nuc_7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.49:*:*:*:*:*:*:* | krnl64nuc_7.49 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.22:*:*:*:*:*:*:* | krnl64uc_7.22 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.22ext:*:*:*:*:*:*:* | krnl64uc_7.22ext | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.49:*:*:*:*:*:*:* | krnl64uc_7.49 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.53:*:*:*:*:*:*:* | krnl64uc_7.53 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.73:*:*:*:*:*:*:* | krnl64uc_7.73 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_8.04:*:*:*:*:*:*:* | krnl64uc_8.04 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_as_abap:krnl32nuc_7.22ext:*:*:*:*:*:*:* Versions krnl32nuc_7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22:*:*:*:*:*:*:* Versions krnl64nuc_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:* Versions krnl64nuc_7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:krnl64nuc_7.49:*:*:*:*:*:*:* Versions krnl64nuc_7.49 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.22:*:*:*:*:*:*:* Versions krnl64uc_7.22 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.22ext:*:*:*:*:*:*:* Versions krnl64uc_7.22ext Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.49:*:*:*:*:*:*:* Versions krnl64uc_7.49 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.53:*:*:*:*:*:*:* Versions krnl64uc_7.53 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_7.73:*:*:*:*:*:*:* Versions krnl64uc_7.73 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_as_abap:krnl64uc_8.04:*:*:*:*:*:*:* Versions krnl64uc_8.04 Vulnerable ·SAP
Remediation
- Fix · CNA SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server) (SAP SE) Fixed in 7.22EXT, 7.49, 7.22, 7.53, 7.73, 8.04
Timeline
- 2026-10-02 Threatist record created from CVE-2021-27606
- 2026-10-03 Alias added: GHSA-pgjj-gq5v-p74w
References
More SAP Netweaver As Abap vulnerabilities
- TI-2022-10648 Incorrect authorization in SAP NetWeaver and ABAP Platform CVSS 3.1CRITICAL 9.8
- TI-2019-00223 Missing authorization in SAP ABAP Platform CVSS 3.1HIGH 8.8
- TI-2022-06818 Uncontrolled resource consumption in SAP NetWeaver Application Server for ABAP and ABAP… CVSS 3.1HIGH 7.5
- TI-2021-09084 NULL pointer dereference in SAP NetWeaver ABAP Server and ABAP Platform CVSS 3.1HIGH 7.5
- TI-2021-09083 NULL pointer dereference in SAP NetWeaver ABAP Server and ABAP Platform CVSS 3.1HIGH 7.5
- TI-2021-09082 NULL pointer dereference in SAP NetWeaver ABAP Server and ABAP Platform CVSS 3.1HIGH 7.5
Sources
- CVE-2021-27606 · CVE Program
- CVE-2021-27606 · NVD
- FIRST EPSS
- GHSA-pgjj-gq5v-p74w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences