{"id":"CVE-2026-27688","aliases":["EUVD-2026-10462","GHSA-pgg7-622h-hcmv"],"status":"published","title":"Missing Authorization check in SAP NetWeaver Application Server for ABAP","description":"Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00263,"percentile":0.18351,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-03-10T00:18:55Z","modified":"2026-11-03T22:13:22Z","products":[{"vendor":"sap","product":"netweaver_application_server_abap"},{"vendor":"sap_se","product":"sap netweaver application server for abap"}],"references":[{"url":"https://me.sap.com/notes/3704740","tags":["Permissions Required"]},{"url":"https://url.sap/sapsecuritypatchday","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27688"},{"url":"https://github.com/advisories/GHSA-pgg7-622h-hcmv"}],"sources":{"cve":[{"id":"CVE-2026-27688","title":"Missing Authorization check in SAP NetWeaver Application Server for ABAP","description":"Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.","status":"published","published":"2026-03-10T00:18:55.986Z","modified":"2026-11-03T22:13:22.582Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-03T23:33:09.822755Z"}],"euvd":[{"id":"EUVD-2026-10462","description":"Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.","status":"published","published":"2026-03-10T00:18:55Z","modified":"2026-11-03T22:13:22Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T23:01:34.673315Z"}],"ghsa":[{"id":"GHSA-pgg7-622h-hcmv","title":"Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an...","description":"Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.","status":"published","published":"2026-03-10T18:31:17Z","modified":"2026-03-10T18:31:24Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:06:32.038351Z"}],"nvd":[{"id":"CVE-2026-27688","description":"Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.","status":"published","published":"2026-03-10T17:38:11.497Z","modified":"2026-11-03T23:17:41.197Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-04T01:48:27.339675Z"}]}}