CVE-2026-27671

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 0.44%
EPSS Percentile: 37.95%
CISA KEV: Not listed

Description

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on the confidentiality, integrity, and availability of the application.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 09-Jun-2026 08:16
Last Modified: 23-Jul-2026 15:10
EPSS Date: 2026-10-30
CWE: CWE-121

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 31-Oct-2026 18:10
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

CVE-2026-27671 (CVSS score: 9.8) – Memory corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform Fortinet, Ivanti and SAP Patch Critical Vulnerabilities Across Multiple Products
Organizations using these products should prioritize patching CVE-2026-44748 and CVE-2026-27671 due to their high severity and potential impact on enterprise environments. SAP Patches Critical NetWeaver and Commerce Cloud Flaws
The second critical-severity flaw patched on SAP’s June 2026 security patch day is CVE-2026-27671 (CVSS score of 9.8), a memory corruption issue in NetWeaver and ABAP Platform. SAP Patches Four Critical Vulnerabilities in NetWeaver, Commerce and Data Hub

CVE (8)

People (1)

Vendors (3)

Products (13)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.