SAP NetWeaver AS ABAP Missing Authorization Check (3704740)

medium Nessus Plugin ID 302163

Language:

Synopsis

The remote SAP NetWeaver ABAP server is affected by a missing authorization check vulnerability.

Description

The version of SAP NetWeaver AS ABAP and ABAP Platform detected on the remote host is affected by a missing authorization check vulnerability as referenced in the SAP Security Patch Day March 2026:

- Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected. (CVE-2026-27688)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Apply the appropriate patch according to the vendor advisory.

Plugin Details

Severity: Medium

ID: 302163

File Name: sap_netweaver_as_abap_3704740.nasl

Version: 1.1

Type: remote

Family: Web Servers

Published: 3/13/2026

Updated: 3/13/2026

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.2

CVSS v3

Risk Factor: Medium

Base Score: 5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Vulnerability Information

CPE: cpe:/a:sap:netweaver_application_server

Required KB Items: Settings/ParanoidReport, installed_sw/SAP Netweaver Application Server (AS)

Patch Publication Date: 3/10/2026

Vulnerability Publication Date: 3/10/2026

Reference Information

CVE: CVE-2026-27688

IAVA: 2026-A-0215

Detections

Analytics