Search: CVE-2026-0509

CVE-2026-0509 is a critical vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform that allows authenticated, low-privileged users to execute background Remote Function Calls (RFCs) without proper S_RFC authorization. This missing authorization (CWE-862) can lead to significant integrity and availability impacts, as attackers can perform unauthorized operations affecting system processes. The vulnerability does not impact confidentiality but can severely disrupt business-critical SAP environments. It affects multiple versions of SAP NetWeaver and ABAP Platform, including widely used releases such as 7.53, 7.54, 7.77, and 9.16 through 9.19. Exploitation requires authentication but no user interaction, and the vulnerability has a high CVSS score of 9.