In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740…
Priority LOW 21Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use the S/4 Hana dashboard to reveal systems and services which they would not normally be allowed to see. No information alteration or denial of service is possible.
Why it matters now
EPSS 0.00652 51st percentileScored 2026-11-07
Fix Fixed SAP NetWeaver AS for ABAP and ABAP Platform (SAP SE): 701, 702, 711 +11
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAP | SAP NetWeaver AS for ABAP and ABAP Platform | before 701; before 702; before 711; before 730; before 731; before 740; before 750; before 751; before 752; before 753; before 754; before 755; before 756; before 786 | 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786 | Patch available | CNA |
- SAP NetWeaver AS for ABAP and ABAP Platform VendorSAP Affected before 701; before 702; before 711; before 730; before 731; before 740; before 750; before 751; before 752; before 753; before 754; before 755; before 756; before 786 Fixed in 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786 Patch available CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_abap:701:*:*:*:*:*:*:* | 701 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:702:*:*:*:*:*:*:* | 702 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:711:*:*:*:*:*:*:* | 711 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:730:*:*:*:*:*:*:* | 730 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:731:*:*:*:*:*:*:* | 731 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:740:*:*:*:*:*:*:* | 740 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:750:*:*:*:*:*:*:* | 750 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:751:*:*:*:*:*:*:* | 751 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:752:*:*:*:*:*:*:* | 752 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:753:*:*:*:*:*:*:* | 753 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_abap:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:711:*:*:*:*:*:*:* Versions 711 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sap:netweaver_abap:754:*:*:*:*:*:*:* | 754 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:755:*:*:*:*:*:*:* | 755 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:756:*:*:*:*:*:*:* | 756 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_abap:786:*:*:*:*:*:*:* | 786 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* | 701 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* | 702 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:* | 711 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:* | 730 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* | 731 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* | 740 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* | 750 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* | 751 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* | 752 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* | 753 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:* | 754 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:* | 755 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:*:*:*:* | 756 | Vulnerable | SAP |
| cpe:2.3:a:sap:netweaver_application_server_abap:786:*:*:*:*:*:*:* | 786 | Vulnerable | SAP |
- cpe:2.3:a:sap:netweaver_abap:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:756:*:*:*:*:*:*:* Versions 756 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_abap:786:*:*:*:*:*:*:* Versions 786 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:*:*:*:* Versions 701 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:*:*:*:* Versions 702 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:711:*:*:*:*:*:*:* Versions 711 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:730:*:*:*:*:*:*:* Versions 730 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:*:*:*:* Versions 731 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:*:*:*:* Versions 740 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:*:*:*:* Versions 750 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:751:*:*:*:*:*:*:* Versions 751 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:*:*:*:* Versions 752 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:*:*:*:* Versions 753 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:*:*:*:* Versions 754 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:*:*:*:* Versions 755 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:*:*:*:* Versions 756 Vulnerable ·SAP
- cpe:2.3:a:sap:netweaver_application_server_abap:786:*:*:*:*:*:*:* Versions 786 Vulnerable ·SAP
Remediation
- Fix · CNA SAP NetWeaver AS for ABAP and ABAP Platform (SAP SE) Fixed in 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786
Timeline
- 2026-10-02 Threatist record created from CVE-2021-42067
- 2026-10-03 Alias added: GHSA-mqm8-93xw-f4w3
- 2026-10-27 EPSS moved to the 50th–90th percentile
References
More SAP Netweaver Abap vulnerabilities
- TI-2012-03697 Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow… CVSS 2.0HIGH 10.0
- TI-2021-09062 Improper authentication in SAP NetWeaver AS ABAP and ABAP Platform CVSS 3.1CRITICAL 9.8
- TI-2021-15856 The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700… CVSS 3.1HIGH 8.8
- TI-2022-06818 Uncontrolled resource consumption in SAP NetWeaver Application Server for ABAP and ABAP… CVSS 3.1HIGH 7.5
- TI-2021-09085 Out-of-bounds write in SAP NetWeaver AS for ABAP CVSS 3.1HIGH 7.5
- TI-2021-09049 Out-of-bounds read in SAP NetWeaver AS for ABAP CVSS 3.1HIGH 7.5
Sources
- CVE-2021-42067 · CVE Program
- CVE-2021-42067 · NVD
- FIRST EPSS
- GHSA-mqm8-93xw-f4w3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences