{"id":"CVE-2026-24309","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-24309","generatedAt":"2026-10-28T02:22:59.149Z","title":"Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify or insert entries into the database configuration table of the ABAP system.","description":"Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify or insert entries into the database configuration table of the ABAP system. This unauthorized content change could lead to reduced system performance or interruptions. The vulnerability has low impact on the application's integrity and availability, with no effect on confidentiality.","published":"2026-03-10T17:35:55.000Z","lastModified":"2026-06-17T10:22:53.000Z","status":"Analyzed","sourceIdentifier":"cna@sap.com","cvss":{"version":"3.1","score":6.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L"},"cwe":["CWE-862"],"affected":["sap/netweaver application server abap"],"epss":{"score":0.00209,"percentile":0.10886,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://me.sap.com/notes/3703856","tags":["Permissions Required"],"source":"cna@sap.com"},{"url":"https://url.sap/sapsecuritypatchday","tags":["Vendor Advisory"],"source":"cna@sap.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-24309","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}