Code injection in SAP NetWeaver AS ABAP
Priority LOW 34CWE-95Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-95.
Summary
A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable.
Why it matters now
EPSS 0.02546 85th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed SAP NetWeaver AS ABAP (Reconciliation Framework) (SAP SE): 700, 701, 702 +14
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP NetWeaver AS ABAP (Reconciliation Framework) | before 700; before 701; before 702; before 710; before 711; before 730; before 731; before 740; before 750; before 751; before 752; before 75A; before 75B; before 75C; before 75D; before 75E; before 75F | 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, 75F | Patch available | CNA |
- SAP NetWeaver AS ABAP (Reconciliation Framework) VendorSAP Affected before 700; before 701; before 702; before 710; before 711; before 730; before 731; before 740; before 750; before 751; before 752; before 75A; before 75B; before 75C; before 75D; before 75E; before 75F Fixed in 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, 75F Patch available CNA
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_application_server_abap:75a:*:*:*:*:*:*:* | 75a | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:75b:*:*:*:*:*:*:* | 75b | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:75c:*:*:*:*:*:*:* | 75c | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:75d:*:*:*:*:*:*:* | 75d | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:75e:*:*:*:*:*:*:* | 75e | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:75f:*:*:*:*:*:*:* | 75f | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:* | 700 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* | 701 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* | 702 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:* | 710 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_application_server_abap:75a:*:*:*:*:*:*:* Versions 75a Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:75b:*:*:*:*:*:*:* Versions 75b Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:75c:*:*:*:*:*:*:* Versions 75c Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:75d:*:*:*:*:*:*:* Versions 75d Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:75e:*:*:*:*:*:*:* Versions 75e Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:75f:*:*:*:*:*:*:* Versions 75f Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:* Versions 710 Vulnerable ·SAP
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:* | 711 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:* | 730 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* | 731 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* | 740 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* | 750 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* | 751 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* | 752 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:* Versions 711 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
Remediation
- Fix · CNA SAP NetWeaver AS ABAP (Reconciliation Framework) (SAP SE) Fixed in 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, 75F
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33678
- 2026-10-03 Alias added: GHSA-85h8-fmxx-x269
References
Exploit 2
More SAP Netweaver Application Server Abap vulnerabilities
- TI-2022-06811 SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP… KEVCVSS 3.1CRITICAL 10.0
- TI-2023-21149 Missing Authorization check in SAP CommonCryptoLib CVSS 3.1CRITICAL 9.8
- TI-2023-12229 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
- TI-2023-12228 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform CVSS 3.1CRITICAL 9.6
- TI-2021-19921 Code injection in SAP ABAP Server & ABAP Platform CVSS 3.1CRITICAL 9.8
- TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-33678 · CVE Program
- CVE-2021-33678 · NVD
- FIRST EPSS
- GHSA-85h8-fmxx-x269 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences