Read the docs
TI-2021-09086 Aliases CVE-2021-27634GHSA-v752-6j86-7g43

Out-of-bounds write in SAP NetWeaver AS for ABAP

Priority LOW 29CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73,7.77,7.81,7.82,7.83, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method ThCpicDtCreate () causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

Why it matters now

EPSS 0.01325 71st percentileScored 2026-11-07
Fix Fixed SAP NetWeaver AS for ABAP (RFC Gateway) (SAP SE): 7.22EXT, 7.49, 7.22 +7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP NetWeaver AS for ABAP (RFC Gateway)< KRNL32NUC - 7.22; before 7.22EXT; < KRNL64NUC - 7.22; before 7.49; < KRNL64UC - 8.04; before 7.22; before 7.53; before 7.73; < KERNEL - 7.22; before 8.04; before 7.77; before 7.81; before 7.82; before 7.837.22EXT, 7.49, 7.22, 7.53, 7.73, 8.04, 7.77, 7.81, 7.82, 7.83Patch availableCNA
  • SAP NetWeaver AS for ABAP (RFC Gateway) VendorSAP Affected < KRNL32NUC - 7.22; before 7.22EXT; < KRNL64NUC - 7.22; before 7.49; < KRNL64UC - 8.04; before 7.22; before 7.53; before 7.73; < KERNEL - 7.22; before 8.04; before 7.77; before 7.81; before 7.82; before 7.83 Fixed in 7.22EXT, 7.49, 7.22, 7.53, 7.73, 8.04, 7.77, 7.81, 7.82, 7.83 Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_abap:kernel_7.22:*:*:*:*:*:*:*kernel_7.22VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:kernel_7.49:*:*:*:*:*:*:*kernel_7.49VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:kernel_7.53:*:*:*:*:*:*:*kernel_7.53VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:kernel_7.73:*:*:*:*:*:*:*kernel_7.73VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:kernel_8.04:*:*:*:*:*:*:*kernel_8.04VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl32nuc_7.22:*:*:*:*:*:*:*krnl32nuc_7.22VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl32nuc_7.22ext:*:*:*:*:*:*:*krnl32nuc_7.22extVulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22:*:*:*:*:*:*:*krnl64nuc_7.22VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:*krnl64nuc_7.22extVulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.49:*:*:*:*:*:*:*krnl64nuc_7.49VulnerableSAP
  • cpe:2.3:a:sap:netweaver_abap:kernel_7.22:*:*:*:*:*:*:* Versions kernel_7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:kernel_7.49:*:*:*:*:*:*:* Versions kernel_7.49 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:kernel_7.53:*:*:*:*:*:*:* Versions kernel_7.53 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:kernel_7.73:*:*:*:*:*:*:* Versions kernel_7.73 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:kernel_8.04:*:*:*:*:*:*:* Versions kernel_8.04 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl32nuc_7.22:*:*:*:*:*:*:* Versions krnl32nuc_7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl32nuc_7.22ext:*:*:*:*:*:*:* Versions krnl32nuc_7.22ext Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22:*:*:*:*:*:*:* Versions krnl64nuc_7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.22ext:*:*:*:*:*:*:* Versions krnl64nuc_7.22ext Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64nuc_7.49:*:*:*:*:*:*:* Versions krnl64nuc_7.49 Vulnerable ·SAP
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.22:*:*:*:*:*:*:*krnl64uc_7.22VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.22ext:*:*:*:*:*:*:*krnl64uc_7.22extVulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.49:*:*:*:*:*:*:*krnl64uc_7.49VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.53:*:*:*:*:*:*:*krnl64uc_7.53VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.73:*:*:*:*:*:*:*krnl64uc_7.73VulnerableSAP
cpe:2.3:a:sap:netweaver_abap:krnl64uc_8.04:*:*:*:*:*:*:*krnl64uc_8.04VulnerableSAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.22:*:*:*:*:*:*:* Versions krnl64uc_7.22 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.22ext:*:*:*:*:*:*:* Versions krnl64uc_7.22ext Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.49:*:*:*:*:*:*:* Versions krnl64uc_7.49 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.53:*:*:*:*:*:*:* Versions krnl64uc_7.53 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64uc_7.73:*:*:*:*:*:*:* Versions krnl64uc_7.73 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_abap:krnl64uc_8.04:*:*:*:*:*:*:* Versions krnl64uc_8.04 Vulnerable ·SAP

Remediation

  • Fix · CNA SAP NetWeaver AS for ABAP (RFC Gateway) (SAP SE) Fixed in 7.22EXT, 7.49, 7.22, 7.53, 7.73, 8.04, 7.77, 7.81, 7.82, 7.83

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-27634
  2. 2026-10-03 Alias added: GHSA-v752-6j86-7g43

References

Advisory 2

  • TI-2012-03697 Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow… CVSS 2.0HIGH 10.0
  • TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8
  • TI-2021-15856 The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700… CVSS 3.1HIGH 8.8
  • TI-2022-06818 Uncontrolled resource consumption in SAP NetWeaver Application Server for ABAP and ABAP… CVSS 3.1HIGH 7.5
  • TI-2021-09085 Out-of-bounds write in SAP NetWeaver AS for ABAP CVSS 3.1HIGH 7.5
  • TI-2021-09049 Out-of-bounds read in SAP NetWeaver AS for ABAP CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences