Read the docs
TI-2022-10648 Aliases CVE-2022-27668GHSA-9xfm-7rcv-qrx6

Incorrect authorization in SAP NetWeaver and ABAP Platform

Priority MEDIUM 46CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.87, 7.88, KRNL64NUC 7.49, KRNL64UC 7.49, SAP_ROUTER 7.53, 7.22, from a remote client, for example stopping the SAProuter, that could highly impact systems availability.

Why it matters now

EPSS 0.02203 82nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SAPSAP NetWeaver and ABAP PlatformKERNEL 7.49; 7.77; 7.81; 7.85; 7.86; 7.87; 7.88; KRNL64NUC 7.49; KRNL64UC 7.49; SAP_ROUTER 7.53; 7.22—No fix listedCNA
  • SAP NetWeaver and ABAP Platform VendorSAP Affected KERNEL 7.49; 7.77; 7.81; 7.85; 7.86; 7.87; 7.88; KRNL64NUC 7.49; KRNL64UC 7.49; SAP_ROUTER 7.53; 7.22 Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:sap:netweaver_as_abap:kernel_7.49:*:*:*:*:*:*:*kernel_7.49VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:kernel_7.77:*:*:*:*:*:*:*kernel_7.77VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:kernel_7.81:*:*:*:*:*:*:*kernel_7.81VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:kernel_7.85:*:*:*:*:*:*:*kernel_7.85VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:kernel_7.86:*:*:*:*:*:*:*kernel_7.86VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:kernel_7.87:*:*:*:*:*:*:*kernel_7.87VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap:kernel_7.88:*:*:*:*:*:*:*kernel_7.88VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap_krnl64nuc:7.49:*:*:*:*:*:*:*7.49VulnerableSAP
cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.49:*:*:*:*:*:*:*7.49VulnerableSAP
cpe:2.3:a:sap:router:7.22:*:*:*:*:*:*:*7.22VulnerableSAP
  • cpe:2.3:a:sap:netweaver_as_abap:kernel_7.49:*:*:*:*:*:*:* Versions kernel_7.49 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:kernel_7.77:*:*:*:*:*:*:* Versions kernel_7.77 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:kernel_7.81:*:*:*:*:*:*:* Versions kernel_7.81 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:kernel_7.85:*:*:*:*:*:*:* Versions kernel_7.85 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:kernel_7.86:*:*:*:*:*:*:* Versions kernel_7.86 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:kernel_7.87:*:*:*:*:*:*:* Versions kernel_7.87 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap:kernel_7.88:*:*:*:*:*:*:* Versions kernel_7.88 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap_krnl64nuc:7.49:*:*:*:*:*:*:* Versions 7.49 Vulnerable ·SAP
  • cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.49:*:*:*:*:*:*:* Versions 7.49 Vulnerable ·SAP
  • cpe:2.3:a:sap:router:7.22:*:*:*:*:*:*:* Versions 7.22 Vulnerable ·SAP
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sap:router:7.53:*:*:*:*:*:*:*7.53VulnerableSAP
  • cpe:2.3:a:sap:router:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-27668
  2. 2026-10-03 Alias added: GHSA-9xfm-7rcv-qrx6

References

Exploit 2

Advisory 2

  • TI-2019-00223 Missing authorization in SAP ABAP Platform CVSS 3.1HIGH 8.8
  • TI-2022-06818 Uncontrolled resource consumption in SAP NetWeaver Application Server for ABAP and ABAP… CVSS 3.1HIGH 7.5
  • TI-2021-09084 NULL pointer dereference in SAP NetWeaver ABAP Server and ABAP Platform CVSS 3.1HIGH 7.5
  • TI-2021-09083 NULL pointer dereference in SAP NetWeaver ABAP Server and ABAP Platform CVSS 3.1HIGH 7.5
  • TI-2021-09082 NULL pointer dereference in SAP NetWeaver ABAP Server and ABAP Platform CVSS 3.1HIGH 7.5
  • TI-2021-09081 Out-of-bounds read in SAP NetWeaver ABAP Server and ABAP Platform CVSS 3.1HIGH 7.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences