CVE-2026-0506

Summary

Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs, resulting in a high impact on integrity and availability, while confidentiality remains unaffected.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 700affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 701affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 702affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 731affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 740affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 750affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 751affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 752affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 753affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 754affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 755affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 756affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 757affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 758affected
SAP_SESAP NetWeaver Application Server ABAP and ABAP PlatformSAP_BASIS 816affected

Weaknesses

  • CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References