CVE-2026-24309: Missing Authorization check in SAP NetWeaver Application Server for ABAP
Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify or insert entries into the database configuration table of the ABAP system. This unauthorized content change could lead to reduced system performance or interruptions. The vulnerability has low impact on the application's integrity and availability, with no effect on confidentiality.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24309?
The severity of CVE-2026-24309 is classified as critical due to the potential for unauthorized database access.
How do I fix CVE-2026-24309?
To fix CVE-2026-24309, ensure that the authorization checks are properly implemented for the ABAP function modules involved.
What versions of SAP NetWeaver Application Server for ABAP are affected by CVE-2026-24309?
CVE-2026-24309 affects various unspecified versions of SAP NetWeaver Application Server for ABAP that lack the necessary authorization checks.
What impact does CVE-2026-24309 have on my SAP environment?
The impact of CVE-2026-24309 allows authenticated attackers to read, modify, or insert entries into critical database configuration tables.
Is there a patch available for CVE-2026-24309?
Yes, SAP provides patches to mitigate CVE-2026-24309, which should be applied promptly.