CVE-2026-27671: Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform

Synopsis

A memory corruption vulnerability exists in the SAP Kernel component of SAP NetWeaver Application Server ABAP and ABAP Platform. The flaw is reachable over the network with no authentication required, stemming from improper validation of RFC (Remote Function Call) protocol input that triggers logical errors in memory management. Successful exploitation gives an attacker full read and write access to the affected application and can crash it entirely. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment SAP publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SAP NetWeaver AS ABAP RFC listener over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No credentials or session token of any kind are required; the malicious RFC request can be sent by any unauthenticated party.

• Victim interactionNot required

  Exploitation is fully server-side; no user action, click, or session participation is needed from any victim.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no race-condition or environmental precondition on the attacker.

Blast Radius

• An attacker reads arbitrary in-process memory, exposing session tokens, credentials, and application data held by the AS ABAP kernel.
• An attacker writes to arbitrary memory regions, allowing modification of persisted business data or injection of malicious logic into running processes.
• The affected SAP NetWeaver AS ABAP instance can be crashed, taking down all ABAP workloads and RFC-dependent integrations that rely on it.
• Kernel-level memory corruption may allow an attacker to pivot to remote code execution within the application server process.