CVE-2026-27688
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log File…
Published Mar 10, 2026 · updated Jun 17, 2026 · sap netweaver application server abap
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 10, 2026 · NIST NVD
Detected
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidenti
Jun 17, 2026 · NIST NVD
Updated
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidenti
Affected
- cpe sap/netweaver application server abap700
- cpe sap/netweaver application server abap701
- cpe sap/netweaver application server abap702
- cpe sap/netweaver application server abap730
- cpe sap/netweaver application server abap731
- cpe sap/netweaver application server abap740
- cpe sap/netweaver application server abap750
- cpe sap/netweaver application server abap751
Sources
- CVE.orgVulnerability recordCVE-2026-27688
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-27688
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module
nvd.nist.gov