Missing authorization in SAP ABAP Platform Kernel
Priority LOW 37CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.
Summary
SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in escalation of privileges. That means this business user is able to read and modify data beyond the vulnerable system. However, the attacker can neither significantly reduce the performance of the system nor stop the system.
Why it matters now
EPSS 0.00758 55th percentileScored 2026-11-07
Fix Fixed SAP ABAP Platform Kernel (SAP SE): 7.77, 7.81, 7.85 +1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP ABAP Platform Kernel | before 7.77; before 7.81; before 7.85; before 7.86 | 7.77, 7.81, 7.85, 7.86 | Patch available | CNA |
- SAP ABAP Platform Kernel VendorSAP Affected before 7.77; before 7.81; before 7.85; before 7.86 Fixed in 7.77, 7.81, 7.85, 7.86 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:abap_platform_kernel:7.77:*:*:*:*:*:*:* | 7.77 | Vulnerable | SAP |
| cpe:2.3:a:sap:abap_platform_kernel:7.81:*:*:*:*:*:*:* | 7.81 | Vulnerable | SAP |
| cpe:2.3:a:sap:abap_platform_kernel:7.85:*:*:*:*:*:*:* | 7.85 | Vulnerable | SAP |
| cpe:2.3:a:sap:abap_platform_kernel:7.86:*:*:*:*:*:*:* | 7.86 | Vulnerable | SAP |
- cpe:2.3:a:sap:abap_platform_kernel:7.77:*:*:*:*:*:*:* Versions 7.77 Vulnerable ·SAP
- cpe:2.3:a:sap:abap_platform_kernel:7.81:*:*:*:*:*:*:* Versions 7.81 Vulnerable ·SAP
- cpe:2.3:a:sap:abap_platform_kernel:7.85:*:*:*:*:*:*:* Versions 7.85 Vulnerable ·SAP
- cpe:2.3:a:sap:abap_platform_kernel:7.86:*:*:*:*:*:*:* Versions 7.86 Vulnerable ·SAP
Remediation
- Fix · CNA SAP ABAP Platform Kernel (SAP SE) Fixed in 7.77, 7.81, 7.85, 7.86
Timeline
- 2026-10-02 Threatist record created from CVE-2021-40501
- 2026-10-03 Alias added: GHSA-wh2j-mxwv-765p
References
More SAP Abap Platform Kernel vulnerabilities
- TI-2023-13550 IP filter vulnerability in ABAP Platform and SAP Web Dispatcher CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-40501 · CVE Program
- CVE-2021-40501 · NVD
- FIRST EPSS
- GHSA-wh2j-mxwv-765p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences