CVE-2026-27688
Analyzed Analyzed - Analysis Complete
Missing Authorization Allows Sensitive Log Access in SAP NetWeaver

Publication date: 2026-03-10

Last updated on: 2026-06-03

Assigner: SAP SE

Description
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-06-03
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27688
EUVD
EUVD-2026-10462
Affected Vendors & Products
Showing 16 associated CPEs
Vendor Product Version / Range
sap netweaver_application_server_abap 702
sap netweaver_application_server_abap 700
sap netweaver_application_server_abap 701
sap netweaver_application_server_abap 730
sap netweaver_application_server_abap 731
sap netweaver_application_server_abap 740
sap netweaver_application_server_abap 750
sap netweaver_application_server_abap 751
sap netweaver_application_server_abap 752
sap netweaver_application_server_abap 753
sap netweaver_application_server_abap 754
sap netweaver_application_server_abap 755
sap netweaver_application_server_abap 756
sap netweaver_application_server_abap 757
sap netweaver_application_server_abap 758
sap netweaver_application_server_abap 816
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

The impact of this vulnerability is limited to confidentiality. An attacker with the necessary privileges could read sensitive information from the Database Analyzer Log Files. However, the integrity and availability of the system are not affected by this vulnerability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Executive Summary

This vulnerability exists due to a missing authorization check in SAP NetWeaver Application Server for ABAP. An authenticated attacker who has user privileges and the ability to execute a specific RFC function module can read Database Analyzer Log Files. This means the attacker could potentially escalate their privileges to access sensitive data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27688. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart