CVE-2026-0506

High

Published: 13/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

A Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform allows an authenticated attacker to misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow writing or modifying data accessible via FORMs and invoking system functionality, resulting in high impact on integrity and availability, while confidentiality remains unaffected.

Risk Assessment

An attacker can modify data and invoke system functions, potentially leading to data integrity violations and system disruption.

Recommendation

It is recommended to apply vendor-provided patches and review permission configurations for RFC functions.

Other vulnerabilities in Application Server ABAP

CVE-2026-44751High
The ABAP application server does not perform necessary authorization checks for an authenticated user, allowing execution of a report generation command that can overwrite another user's data, leading to privilege escalation. This has high impact on integrity, low on availability, and no impact on confidentiality.

Original NVD description (English source)

Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs, resulting in a high impact on integrity and availability, while confidentiality remains unaffected.