# CVE-2026-27671: SAP NetWeaver and ABAP Platform memory corruption in SAP Kernel

Source: https://junglewise.ai/threats/cve-2026-27671-sap-netweaver-and-abap-platform-memory-corruption-in-sap-kernel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-27671 · Severity: critical · CVSS 9.8 · Published 2026-06-09

A critical vulnerability exists in the SAP Kernel, the core engine powering SAP NetWeaver and ABAP platforms. An attacker can exploit this flaw over the network without any login credentials to cause memory corruption on the server. This could allow an unauthorized party to gain full control over the application, potentially leading to the theft of sensitive business data, system downtime, or unauthorized modification of records.

Technologies: [SAP NetWeaver Application Server ABAP](https://junglewise.ai/threats/technologies/netweaver-application-server-abap). Vendors: [SAP](https://junglewise.ai/threats/vendors/sap).

## Quick answers

**Is CVE-2026-27671 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27671 being exploited in the wild.

**How severe is CVE-2026-27671?** Critical severity, with a CVSS score of 9.8, published 9 June 2026.

**Which products and versions are affected?** SAP NetWeaver Application Server ABAP All versions using affected SAP Kernel.

**Is there a fix for CVE-2026-27671?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-27671 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-27671?** Check whether you run SAP NetWeaver Application Server ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the SAP Kernel used by SAP NetWeaver Application Server ABAP and the ABAP Platform. The vulnerability is rooted in improper validation of Remote Function Call (RFC) protocol requests. An unauthenticated remote attacker can send a specially crafted RFC request to trigger logical errors in memory management, leading to memory corruption. Successful exploitation provides the attacker with high-impact access to confidentiality, integrity, and availability, effectively allowing for arbitrary code execution or complete system takeover. SAP has released security note 3717897 to address this issue.

## Affected products

- SAP NetWeaver Application Server ABAP All versions using affected SAP Kernel
- SAP ABAP Platform All versions using affected SAP Kernel

## Timeline

- 2026-06-09: advisory: Initial disclosure by SAP during June 2026 Patch Day

## References

- [https://me.sap.com/notes/3717897](https://me.sap.com/notes/3717897)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)

## Related threats

- [SAP Web Dispatcher and NetWeaver Application Server ABAP CSRF in administrative functionality](https://junglewise.ai/threats/cve-2026-89119-sap-web-dispatcher-and-sap-netweaver-application-server-abap)
- [SAP NetWeaver Application Server ABAP memory corruption denial of service](https://junglewise.ai/threats/cve-2026-76970-due-to-a-memory-corruption-vulnerability-in-application-server)
- [SAP NetWeaver Application Server ABAP authorization bypass](https://junglewise.ai/threats/cve-2026-76965-sap-netweaver-application-server-abap-and-abap-platform-does-not)
- [SAP NetWeaver Application Server ABAP memory corruption](https://junglewise.ai/threats/cve-2026-76964-sap-netweaver-application-server-abap-does-not-sufficiently)
- [SAP NetWeaver Application Server ABAP memory disclosure](https://junglewise.ai/threats/cve-2026-109796-sap-netweaver-application-server-abap-and-abap-platform-does-not)