What is CVE-2021-21466?

CVE-2021-21466 is a high-severity vulnerability in SAP Business Warehouse, classified under Code Injection. CVSS score: 8.8/10. Published 2021-01-12.

How severe is CVE-2021-21466?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2021-21466 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in SAP Business Warehouse

CVE-2021-21466

SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attacker to inject code using a remote enabled function module over the network. Via the function module an attacker can create a malicious ABAP report which could be used to get access to sensitive data, to inject malicious UPDATE statements that could have also impact on the operating system, to disrupt the functionality of the SAP system which can thereby lead to a Denial of Service.

Vulnerability class: RCE (Remote Code Execution)

Published 2021-01-12 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.031 (87.2th percentile), scored 2026-10-01.

Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 87.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.031 · newest: 0.031 · change: 0.000

Affected products

SAP Business Warehouse — versions 700, 701, 702
SAP Bw\/4hana — versions 100, 200
SAP Se Business Warehouse — versions < 700, < 701, < 702
SAP Se Bw/4hana — versions < 100, < 200

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

wiki.scn.sap.com/wiki/pages/viewpage.action (Vendor Advisory)
launchpad.support.sap.com/ (Permissions Required, Vendor Advisory)
seclists.org/fulldisclosure/2022/May/42 (mailing-list, Exploit, Mailing List, Third Party Advisory)
packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-… (Exploit, VDB Entry, Third Party Advisory)

Frequently asked questions

What is CVE-2021-21466?: CVE-2021-21466 is a high-severity vulnerability in SAP Business Warehouse, classified under Code Injection. CVSS score: 8.8/10. Published 2021-01-12.
How severe is CVE-2021-21466?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2021-21466 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.