What is CVE-2026-0509?

CVE-2026-0509 is a critical-severity vulnerability in Sap Netweaver_as_abap_kernel, classified under Missing Authorization. CVSS score: 9.6/10. Published 2026-02-10.

How severe is CVE-2026-0509?

Critical severity. CVSS v3 base score is 9.6 out of 10.

Auth bypass in Sap Netweaver_as_abap_kernel

CVE-2026-0509

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on…

Vulnerability class: Broken Access Control

EPSS: 0.003 (25.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H.

Affected products

Sap Netweaver_as_abap_kernel — versions 7.22, 7.53, 7.54
Sap Netweaver_as_abap_krnl64nuc — versions 7.22, 7.22ext
Sap Netweaver_as_abap_krnl64uc — versions 7.22, 7.22ext, 7.53
Sap_se Sap Netweaver Application Server Abap And Platform — versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cna@sap.com (Permissions Required)
cna@sap.com (Vendor Advisory)

Frequently asked questions

What is CVE-2026-0509?: CVE-2026-0509 is a critical-severity vulnerability in Sap Netweaver_as_abap_kernel, classified under Missing Authorization. CVSS score: 9.6/10. Published 2026-02-10.
How severe is CVE-2026-0509?: Critical severity. CVSS v3 base score is 9.6 out of 10.