This vulnerability (CVE-2026-27671) involves a stack-based buffer overflow (CWE-121) in the SAP Kernel component of SAP NetWeaver and ABAP Platform. The root cause is improper validation of the Remote Function Call (RFC) protocol, which allows an unauthenticated attacker to send specially crafted RFC requests. These requests exploit logical errors in memory management, resulting in memory corruption. The vulnerability affects various versions including 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, and 91.9. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation can lead to memory corruption, which may compromise the confidentiality, integrity, and availability of the affected SAP NetWeaver and ABAP Platform systems. The vulnerability can be exploited remotely without authentication, increasing the risk of widespread impact. Given the critical CVSS score of 9.8, the potential impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor SAP security advisories closely. Given the unauthenticated remote attack vector, consider restricting network access to SAP RFC interfaces where possible and apply compensating controls as recommended by SAP once available.