CVE-2026-0509 — Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC autho…
Published: 2026-02-10 · CVSS: 9.6 · CVSS 3.1
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no impact on the confidentiality of the application.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7