CVE-2026-0506— Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform
Quick assessment
Affected
SAP_SE SAP NetWeaver Application Server ABAP and ABAP Platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP NetWeaver Application Server是德国思爱普（SAP）公司的一款应用程序服务器。 SAP NetWeaver Application Server存在安全漏洞，该漏洞源于缺少授权检查，可能导致已验证攻击者滥用RFC函数执行ABAP系统中的表单例程，对完整性和可用性造成高影响。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-0506
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform
Source: CVE Program / CVE List V5
Vulnerability Description
Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs, resulting in a high impact on integrity and availability, while confidentiality remains unaffected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
SAP NetWeaver Application Server 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP NetWeaver Application Server是德国思爱普（SAP）公司的一款应用程序服务器。 SAP NetWeaver Application Server存在安全漏洞，该漏洞源于缺少授权检查，可能导致已验证攻击者滥用RFC函数执行ABAP系统中的表单例程，对完整性和可用性造成高影响。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP NetWeaver Application Server ABAP and ABAP Platform | SAP_BASIS 700 | - |
|
II. Public POCs for CVE-2026-0506
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-0506
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2026-01-13 · 19 CVEs total
| CVE-2026-0501 | 9.9 CRITICAL | SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials � Gene |
| CVE-2026-0500 | 9.6 CRITICAL | Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation) |
| CVE-2026-0491 | 9.1 CRITICAL | Code Injection vulnerability in SAP Landscape Transformation |
| CVE-2026-0498 | 9.1 CRITICAL | Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise) |
| CVE-2026-0492 | 8.8 HIGH | Privilege escalation vulnerability in SAP HANA database |
| CVE-2026-0507 | 8.4 HIGH | OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RF |
| CVE-2026-0511 | 8.1 HIGH | Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) |
| CVE-2026-0496 | 6.6 MEDIUM | Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) |
| CVE-2026-0503 | 6.4 MEDIUM | Missing Authorization check in in SAP ERP Central Component and SAP S/4HANA (SAP EHS Manag |
| CVE-2026-0499 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-0514 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Business Connector |
| CVE-2026-0495 | 5.1 MEDIUM | Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) |
| CVE-2026-0513 | 4.7 MEDIUM | Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM C |
| CVE-2026-0497 | 4.3 MEDIUM | Missing Authorization check in Business Server Pages Application (Product Designer Web UI) |
| CVE-2026-0494 | 4.3 MEDIUM | Information Disclosure vulnerability in SAP Fiori App (Intercompany Balance Reconciliation |
| CVE-2026-0493 | 4.3 MEDIUM | Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Rec |
| CVE-2026-0504 | 3.8 LOW | Insufficient Input Handling in JNDI Operations of SAP Identity Management |
| CVE-2026-0510 | 3.0 LOW | Obsolete Encryption Algorithm Used in NW AS Java UME User Mapping |
IV. Related Vulnerabilities
Same product: SAP NetWeaver Application Server ABAP and ABAP Platform
-
CVE-2026-58236
OS Command Injection vulnerability in Application Server ABA -
CVE-2026-0509
Missing Authorization check in SAP NetWeaver Application Ser -
CVE-2025-42969
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap -
CVE-2025-31329
Information Disclosure vulnerability in SAP NetWeaver Applic -
CVE-2024-41734
Missing Authorization check in SAP NetWeaver Application Ser
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-862
-
CVE-2026-104914
MISP: Soft-Deleted Attributes from Other Organizations Expos -
CVE-2026-104912
MISP Correlation Authorization Bypass Exposes Restricted Eve -
CVE-2026-96613
Missing Authorization in Meari IoT Cloud Platform OpenAPI Se -
CVE-2026-104910
MISP Information Disclosure via Related Events Listing Bypas -
CVE-2026-101104
Missing Authorization in Meari IoT Cloud Platform OpenAPI Se
V. Comments for CVE-2026-0506
No comments yet