SAP Note 3675151
OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK
HighCVSS 8.4SAP Application Server for ABAP and SAP NetWeaver RFCSDK
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
- CVE(s)
- CVE-2026-0507
- CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products and versions
- Product SAP Application Server for ABAP and SAP NetWeaver RFCSDK
Versions: KRNL64UC 7.53, NWRFCSDK 7.50, KERNEL 7.53, 7.54, 7.77, 7.89, 7.93, 9.16
Appears in
Patch Days listing this note, newest first.
- January 2026HighCVSS 8.4