Is CVE-2026-24309 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24309 being exploited in the wild.

How severe is CVE-2026-24309?

Medium severity, with a CVSS score of 6.4, published 10 March 2026.

Which products and versions are affected?

SAP NetWeaver Application Server for ABAP 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816.

Is there a fix for CVE-2026-24309?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-24309 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-24309?

Check whether you run SAP NetWeaver Application Server for ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24309: SAP NetWeaver AS for ABAP missing authorization check in function module

CVE-2026-24309 · Severity: medium · CVSS 6.4 · Published 2026-03-10

SAP NetWeaver Application Server for ABAP is a foundational platform used to run business applications. A security flaw allows an authorized user to bypass permission checks and modify critical database configuration settings. This could lead to system performance issues or service interruptions, potentially impacting business operations.

Technologies: SAP NetWeaver Application Server for ABAP. Vendors: SAP.

Quick answers

Is CVE-2026-24309 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24309 being exploited in the wild.
How severe is CVE-2026-24309?: Medium severity, with a CVSS score of 6.4, published 10 March 2026.
Which products and versions are affected?: SAP NetWeaver Application Server for ABAP 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816.
Is there a fix for CVE-2026-24309?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-24309 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-24309?: Check whether you run SAP NetWeaver Application Server for ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check (CWE-862) exists in specific ABAP function modules within SAP NetWeaver Application Server for ABAP. An authenticated attacker with low privileges can execute these modules over the network to read, insert, or modify entries in the system's database configuration tables. While the vulnerability does not allow for data theft (confidentiality), it enables unauthorized content changes that can degrade system performance or cause service interruptions. The issue affects multiple SAP_BASIS versions ranging from 700 to 816. SAP has released security note 3703856 to address this vulnerability.

Affected products

SAP NetWeaver Application Server for ABAP (SAP_BASIS) 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816

Timeline

2026-03-10: disclosed: Initial publication by SAP and NVD
2026-03-10: advisory: SAP Security Note 3703856 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.