CVE-2026-0509

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no impact on the confidentiality of the application.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver Application Server ABAP and ABAP Platform	KRNL64NUC 7.22; 7.22EXT; KRNL64UC 7.22; 7.53; KERNEL 7.22; 7.54; 7.77; 7.89; 7.93; 9.16; 9.18; 9.19

References

https://me.sap.com/notes/3674774Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-05103.0The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encr CVE-2026-05118.1SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in es CVE-2026-05126.1Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthentica CVE-2026-05134.7Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker cou CVE-2026-05146.1Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When CVE-2026-05156.2Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutri CVE-2026-05166.5A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host CVE-2026-05177.5CVE-2026-0517 is a denial-of-service vulnerability in versions of Secure Access Server prior to 14.20. An attacker can send a specially cra CVE-2026-05184.8CVE-2026-0518 is a cross-site scripting vulnerability in versions of Secure Access prior to 14.20. An attacker with administrative privileg CVE-2026-05193.4In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain config CVE-2026-05202.8A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authentic CVE-2026-05216.1A reflected cross-site scripting (XSS) vulnerability in the PDF export functionality of the TYDAC AG MAP+ solution allows unauthenticated at