CVE-2021-27606

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server), versions - KRNL32NUC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL - 7.22,8.04,7.49,7.53,7.73, allows an unauthenticated attacker without specific knowledge of the system to send a specially crafted packet over a network which will trigger an internal error in the system due to improper input validation in method EncOAMParamStore() causing the system to crash and rendering it unavailable. In this attack, no data in the system can be viewed or modified.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
SAP SE	SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server)	< KRNL32NUC - 7.22; < 7.22EXT; < KRNL64NUC - 7.22; < 7.49; < KRNL64UC - 8.04; < 7.22; < 7.53; < 7.73; < KERNEL - 7.22; < 8.04

References

https://launchpad.support.sap.com/#/notes/3020104Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999Broken Link, Vendor Advisory
https://launchpad.support.sap.com/#/notes/3020104Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999Broken Link, Vendor Advisory

Timeline

Published: Jun 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-276077.5SAP NetWeaver ABAP Server and ABAP Platform (Dispatcher), versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.2 CVE-2021-276087.5An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process that is performed wh CVE-2021-276096.5SAP Focused RUN versions 200, 300, does not perform necessary authorization checks for an authenticated user, which allows a user to call th CVE-2021-276109.8SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create informat CVE-2021-276116.7SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP re CVE-2021-276126.1In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could CVE-2021-276137.8Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, allows an attacker to CVE-2021-276147.1SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP HANA, allows an atta CVE-2021-276155.4SAP Manufacturing Execution versions - 15.1, 1.5.2, 15.3, 15.4, does not contain some HTTP security headers in their HTTP response. The lack CVE-2021-276167.8Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One f CVE-2021-276174.9The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently vali CVE-2021-276184.9The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file ty