Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform
Priority MEDIUM 45CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal and external RFC user in consistent and distinguished format, which could lead to improper authentication and may be exploited by malicious users to obtain illegitimate access to the system.
Why it matters now
EPSS 0.0132 71st percentileScored 2026-11-07
Fix Fixed SAP NetWeaver AS ABAP and ABAP Platform (SAP SE): 700, 701, 702 +9
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP NetWeaver AS ABAP and ABAP Platform | before 700; before 701; before 702; before 731; before 740; before 750; before 751; before 752; before 753; before 754; before 755; before 804 | 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804 | Patch available | CNA |
- SAP NetWeaver AS ABAP and ABAP Platform VendorSAP Affected before 700; before 701; before 702; before 731; before 740; before 750; before 751; before 752; before 753; before 754; before 755; before 804 Fixed in 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804 Patch available CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_abap:700:*:*:*:*:*:*:* | 700 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:701:*:*:*:*:*:*:* | 701 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:702:*:*:*:*:*:*:* | 702 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:731:*:*:*:*:*:*:* | 731 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:740:*:*:*:*:*:*:* | 740 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:750:*:*:*:*:*:*:* | 750 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:751:*:*:*:*:*:*:* | 751 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:752:*:*:*:*:*:*:* | 752 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:753:*:*:*:*:*:*:* | 753 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:754:*:*:*:*:*:*:* | 754 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_abap:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_abap:755:*:*:*:*:*:*:* | 755 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:804:*:*:*:*:*:*:* | 804 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:* | 700 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* | 701 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* | 702 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* | 731 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* | 740 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* | 750 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* | 751 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* | 752 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* | 753 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:* | 754 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:* | 755 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:804:*:*:*:*:*:*:* | 804 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_abap:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:804:*:*:*:*:*:*:* Versions 804 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:804:*:*:*:*:*:*:* Versions 804 Vulnerable ·SAP
Remediation
- Fix · CNA SAP NetWeaver AS ABAP and ABAP Platform (SAP SE) Fixed in 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804
Timeline
- 2026-10-02 Threatist record created from CVE-2021-27610
- 2026-10-03 Alias added: GHSA-8p63-mg7m-pg66
References
More SAP Netweaver Abap vulnerabilities
- TI-2012-03697 Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow… CVSS 2.0HIGH 10.0
- TI-2021-15856 The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700… CVSS 3.1HIGH 8.8
- TI-2022-06818 Uncontrolled resource consumption in SAP NetWeaver Application Server for ABAP and ABAP… CVSS 3.1HIGH 7.5
- TI-2021-09085 Out-of-bounds write in SAP NetWeaver AS for ABAP CVSS 3.1HIGH 7.5
- TI-2021-09049 Out-of-bounds read in SAP NetWeaver AS for ABAP CVSS 3.1HIGH 7.5
- TI-2021-15859 SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750… CVSS 3.1HIGH 7.5
Sources
- CVE-2021-27610 · CVE Program
- CVE-2021-27610 · NVD
- FIRST EPSS
- GHSA-8p63-mg7m-pg66 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences