CVE-2026-27688

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.

Score

CVSS 3.1 5.0 Medium

Status

Analyzed - cna@sap.com

Published

2026-03-10

Last modified

2026-03-11

Weaknesses

CWE-862

Affected products

• Netweaver Application Server Abap (Sap)
• Sap Netweaver Application Server For Abap (Sap Se)

References

• https://me.sap.com/notes/3704740
• https://url.sap/sapsecuritypatchday