CVE-2026-0506
HighSummary
A Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform allows an authenticated attacker to misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow writing or modifying data accessible via FORMs and invoking system functionality, resulting in high impact on integrity and availability, while confidentiality remains unaffected.
Risk Assessment
An attacker can modify data and invoke system functions, potentially leading to data integrity violations and system disruption.
Recommendation
It is recommended to apply vendor-provided patches and review permission configurations for RFC functions.
Other vulnerabilities in Application Server ABAP
See all- CVE-2026-44751High
The ABAP application server does not perform necessary authorization checks for an authenticated user, allowing execution of a report generation command that can overwrite another user's data, leading to privilege escalation. This has high impact on integrity, low on availability, and no impact on confidentiality.
- CVE-2025-42904Medium
An Information Disclosure vulnerability in Application Server ABAP allows an authenticated attacker to read unmasked values displayed in ABAP Lists. Successful exploitation could lead to unauthorized disclosure of data, resulting in a high impact on confidentiality without affecting integrity or availability.
Original NVD description (English source)
Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs, resulting in a high impact on integrity and availability, while confidentiality remains unaffected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS