CVE-2026-27689— Denial of service (DOS) in SAP Supply Chain Management
Quick assessment
Affected
SAP_SE SAP Supply Chain Management
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP Supply Chain Management是德国思爱普（SAP）公司的一个供应链管理软件。 SAP Supply Chain Management存在安全漏洞，该漏洞源于不受控制的资源消耗，可能导致经过身份验证的攻击者通过调用远程函数模块触发拒绝服务。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-27689
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial of service (DOS) in SAP Supply Chain Management
Source: CVE Program / CVE List V5
Vulnerability Description
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
循环条件输入未经检查
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Supply Chain Management 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Supply Chain Management是德国思爱普（SAP）公司的一个供应链管理软件。 SAP Supply Chain Management存在安全漏洞，该漏洞源于不受控制的资源消耗，可能导致经过身份验证的攻击者通过调用远程函数模块触发拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Supply Chain Management | SCMAPO 713 | - |
|
II. Public POCs for CVE-2026-27689
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-27689
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2026-03-10 · 13 CVEs total
| CVE-2026-27685 | 9.1 CRITICAL | Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration |
| CVE-2026-27684 | 6.4 MEDIUM | SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification) |
| CVE-2026-24316 | 6.4 MEDIUM | Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP |
| CVE-2026-24309 | 6.4 MEDIUM | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2026-0489 | 6.1 MEDIUM | DOM-based Cross-Site Scripting (XSS) Vulnerability in SAP Business One (Job Service) |
| CVE-2026-27686 | 5.9 MEDIUM | Missing Authorization check in SAP Business Warehouse (Service API) |
| CVE-2026-27687 | 5.8 MEDIUM | Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal |
| CVE-2026-24311 | 5.6 MEDIUM | Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0 |
| CVE-2026-27688 | 5.0 MEDIUM | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2026-24317 | 5.0 MEDIUM | DLL Hijacking vulnerability in SAP GUI for Windows with active GuiXT |
| CVE-2026-24313 | 5.0 MEDIUM | Missing Authorization check in SAP Solution Tools Plug-In (ST-PI) |
| CVE-2026-24310 | 3.5 LOW | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad -
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher,
Same weakness: CWE-606
-
CVE-2026-95394
Unchecked Input for Loop Condition in Wireshark -
CVE-2026-16652
Temporal Server Schedule exclusion search can cause excessiv -
CVE-2026-93653
Poppler: poppler: unbounded cpu loop in splashoutputdev::til -
CVE-2026-85730
smol-toml: Denial of Service via malformed TOML documents -
CVE-2026-13761
Pega Platform versions 7.1.0 through 25.1.2 are affected by
V. Comments for CVE-2026-27689
No comments yet