OS Command Injection Vulnerability in SAP Application Server for ABAP and NetWeaver RFCSDK

CVE-2026-0507

What is CVE-2026-0507?

An OS Command Injection vulnerability exists in the SAP Application Server for ABAP and SAP NetWeaver RFCSDK. This flaw allows authenticated attackers with administrative privileges and adjacent network access to upload specially crafted content to the server. If this content is processed by the application, it may lead to the execution of arbitrary operating system commands. This can potentially compromise the system's confidentiality, integrity, and availability, presenting a significant risk to the organization's overall security posture.

References