Is CVE-2026-27688 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27688 being exploited in the wild.

How severe is CVE-2026-27688?

Medium severity, with a CVSS score of 5, published 10 March 2026.

Which products and versions are affected?

SAP NetWeaver Application Server ABAP 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816.

Is there a fix for CVE-2026-27688?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-27688 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-27688?

Check whether you run SAP NetWeaver Application Server ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27688: SAP NetWeaver AS ABAP missing authorization check in RFC function module

CVE-2026-27688 · Severity: medium · CVSS 5 · Published 2026-03-10

SAP NetWeaver Application Server for ABAP, a core component used to run business applications, contains a security flaw where certain log files are not properly protected. An authorized user with basic access could exploit this to view sensitive Database Analyzer log files they should not be able to see. While this does not allow an attacker to change data or crash the system, it could lead to the exposure of internal technical information.

Technologies: SAP NetWeaver Application Server ABAP. Vendors: SAP.

Quick answers

Is CVE-2026-27688 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27688 being exploited in the wild.
How severe is CVE-2026-27688?: Medium severity, with a CVSS score of 5, published 10 March 2026.
Which products and versions are affected?: SAP NetWeaver Application Server ABAP 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816.
Is there a fix for CVE-2026-27688?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-27688 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-27688?: Check whether you run SAP NetWeaver Application Server ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check (CWE-862) exists within a specific Remote Function Call (RFC) function module in SAP NetWeaver Application Server for ABAP (SAP_BASIS). An authenticated attacker with low-level user privileges can execute this module to bypass intended access restrictions and read Database Analyzer Log Files. This vulnerability allows for a limited escalation of privileges regarding data confidentiality, though it does not provide a mechanism to impact system integrity or availability. The issue affects multiple SAP_BASIS versions ranging from 700 to 816, and remediation is typically provided via SAP Security Notes (Note 3704740).

Affected products

SAP NetWeaver Application Server ABAP (SAP_BASIS) 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816

Timeline

2026-03-10: disclosed: Initial disclosure by SAP SE
2026-03-10: advisory: NVD published the CVE entry

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.