CVEFinder.io

CVE-2026-24310

ℹī¸ low
🔍 Scan for this CVE
Summary

Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and read the sensitive information from database catalog of the ABAP system. This vulnerability has low impact on the application's confidentiality with no effect on the integrity and availability.

CVSS Score
3.5
Low
EPSS Score
0.0
Exploit Probability
Published Date
2026-03-10
First Seen: 2026-03-11
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 3.9% of all 330,193 vulnerabilities in our database.

#317,408
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Mar 10, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-06-03
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
CWE IDs (Weakness Types)
CWE-862

đŸ“Ļ Affected Products 13

Vendor Product Status Affected Versions
sap netweaver_application_server_abap Affected
v702
sap netweaver_application_server_abap Affected
v731
sap netweaver_application_server_abap Affected
v740
sap netweaver_application_server_abap Affected
v750
sap netweaver_application_server_abap Affected
v751
sap netweaver_application_server_abap Affected
v752
sap netweaver_application_server_abap Affected
v753
sap netweaver_application_server_abap Affected
v754
sap netweaver_application_server_abap Affected
v755
sap netweaver_application_server_abap Affected
v756
sap netweaver_application_server_abap Affected
v757
sap netweaver_application_server_abap Affected
v758
sap netweaver_application_server_abap Affected
v816

🔗 References 2

https://me.sap.com/notes/3694383
Permissions Required
https://url.sap/sapsecuritypatchday
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-27680 ℹī¸ low 3.1 0.0 Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inj... 2026-05-14
CVE-2026-27682 đŸ”ļ medium 4.7 0.0 Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based... 2026-05-12
CVE-2026-40135 đŸ”ļ medium 6.5 0.1 An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that all... 2026-05-12
CVE-2026-34257 đŸ”ļ medium 6.1 0.1 Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft ... 2026-04-14
CVE-2026-24309 đŸ”ļ medium 6.4 0.1 Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute... 2026-03-10
CVE-2026-24316 đŸ”ļ medium 6.4 0.0 SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP reques... 2026-03-10
These CVEs affect the same products