Critical severity9.6NVD Advisory· Published Feb 10, 2026· Updated Jun 17, 2026
CVE-2026-0509
CVE-2026-0509
Description
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no impact on the confidentiality of the application.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
17- Range: KRNL64NUC 7.22
cpe:2.3:a:sap:netweaver_as_abap_kernel:7.22:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:sap:netweaver_as_abap_kernel:7.22:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_as_abap_kernel:7.53:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_as_abap_kernel:7.54:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_as_abap_kernel:7.77:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_as_abap_kernel:7.89:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_as_abap_kernel:7.93:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_as_abap_kernel:9.16:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_as_abap_kernel:9.18:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_as_abap_kernel:9.19:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap_krnl64nuc:7.22:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:sap:netweaver_as_abap_krnl64nuc:7.22:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_as_abap_krnl64nuc:7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.22:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.22:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.22ext:*:*:*:*:*:*:*
- cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.53:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
2- url.sap/sapsecuritypatchdaynvdVendor Advisory
- me.sap.com/notes/3674774nvdPermissions Required
News mentions
0No linked articles in our index yet.