High severity8.1NVD Advisory· Published Nov 10, 2021· Updated Jun 17, 2026
CVE-2021-40501
CVE-2021-40501
Description
SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business user, resulting in escalation of privileges. That means this business user is able to read and modify data beyond the vulnerable system. However, the attacker can neither significantly reduce the performance of the system nor stop the system.
Affected products
6cpe:2.3:a:sap:abap_platform_kernel:7.77:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:sap:abap_platform_kernel:7.77:*:*:*:*:*:*:*
- cpe:2.3:a:sap:abap_platform_kernel:7.81:*:*:*:*:*:*:*
- cpe:2.3:a:sap:abap_platform_kernel:7.85:*:*:*:*:*:*:*
- cpe:2.3:a:sap:abap_platform_kernel:7.86:*:*:*:*:*:*:*
- (no CPE)range: 7.77, 7.81, 7.85, 7.86
- SAP SE/SAP ABAP Platform Kernelv5Range: < 7.77
Patches
Vulnerability mechanics
References
2- launchpad.support.sap.comnvdPermissions RequiredVendor Advisory
- wiki.scn.sap.com/wiki/pages/viewpage.actionnvdVendor Advisory
News mentions
0No linked articles in our index yet.