The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700…
Priority MEDIUM 41Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, enables a malicious user to transfer ABAP code artifacts or content, by-passing the established quality gates. By this vulnerability malicious code can reach quality and production, and can compromise the confidentiality, integrity, and availability of the system and its data.
Why it matters now
EPSS 0.01294 70th percentileScored 2026-11-07
Fix Fixed SAP NetWeaver AS ABAP and ABAP Platform (SAP SE): 700, 701, 702 +11
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP NetWeaver AS ABAP and ABAP Platform | before 700; before 701; before 702; before 710; before 730; before 731; before 740; before 750; before 751; before 752; before 753; before 754; before 755; before 756 | 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 | Patch available | CNA |
- SAP NetWeaver AS ABAP and ABAP Platform VendorSAP Affected before 700; before 701; before 702; before 710; before 730; before 731; before 740; before 750; before 751; before 752; before 753; before 754; before 755; before 756 Fixed in 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 Patch available CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_abap:700:*:*:*:*:*:*:* | 700 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:701:*:*:*:*:*:*:* | 701 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:702:*:*:*:*:*:*:* | 702 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:710:*:*:*:*:*:*:* | 710 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:730:*:*:*:*:*:*:* | 730 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:731:*:*:*:*:*:*:* | 731 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:740:*:*:*:*:*:*:* | 740 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:750:*:*:*:*:*:*:* | 750 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:751:*:*:*:*:*:*:* | 751 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:752:*:*:*:*:*:*:* | 752 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_abap:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:710:*:*:*:*:*:*:* Versions 710 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_abap:753:*:*:*:*:*:*:* | 753 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:754:*:*:*:*:*:*:* | 754 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:755:*:*:*:*:*:*:* | 755 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:756:*:*:*:*:*:*:* | 756 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:* | 700 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* | 701 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* | 702 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:* | 710 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:* | 730 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* | 731 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* | 740 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* | 750 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* | 751 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* | 752 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* | 753 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:* | 754 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:* | 755 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:*:*:*:* | 756 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_abap:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:756:*:*:*:*:*:*:* Versions 756 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:*:*:*:* Versions 700 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:710:*:*:*:*:*:*:* Versions 710 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:*:*:*:* Versions 756 Vulnerable ·SAP
Remediation
- Fix · CNA SAP NetWeaver AS ABAP and ABAP Platform (SAP SE) Fixed in 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756
Timeline
- 2026-10-02 Threatist record created from CVE-2021-38178
- 2026-10-03 Alias added: GHSA-mg95-qw85-jrq5
References
More SAP Netweaver Abap vulnerabilities
- TI-2012-03697 Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow… CVSS 2.0HIGH 10.0
- TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8
- TI-2022-06818 Uncontrolled resource consumption in SAP NetWeaver Application Server for ABAP and ABAP… CVSS 3.1HIGH 7.5
- TI-2021-09085 Out-of-bounds write in SAP NetWeaver AS for ABAP CVSS 3.1HIGH 7.5
- TI-2021-09049 Out-of-bounds read in SAP NetWeaver AS for ABAP CVSS 3.1HIGH 7.5
- TI-2021-15859 SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750… CVSS 3.1HIGH 7.5
Sources
- CVE-2021-38178 · CVE Program
- CVE-2021-38178 · NVD
- FIRST EPSS
- GHSA-mg95-qw85-jrq5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences