Brief Summary: CVE-2026-27671 — Unauthenticated Stack Buffer Overflow in SAP NetWeaver RFC Kernel

Introduction

An unauthenticated stack-based buffer overflow in the SAP Kernel's RFC protocol handler gives remote attackers a direct path to memory corruption across every Application Server ABAP instance in an organization's SAP landscape. CVE-2026-27671 is scored at CVSS 9.8 and needs no credentials or user interaction. It is one of the most significant SAP vulnerabilities disclosed in 2026, and the latest in a multi-year pattern of critical memory safety failures in SAP's RFC communication layer.

Technical information

Root cause: improper RFC protocol validation

CVE-2026-27671 sits in the SAP Kernel, the base binary layer under every Application Server ABAP instance in SAP NetWeaver and the ABAP Platform. The cause is improper validation of incoming RFC (Remote Function Call) protocol data. When the Kernel processes an RFC request, it does not enforce proper bounds checking before it writes protocol data into a stack-allocated buffer. An attacker can therefore send a crafted RFC request with oversized or malformed data that overflows the buffer.

The vulnerability is classified under CWE-121 (Stack-based Buffer Overflow), which MITRE rates as having a "High" likelihood of exploit. CWE-121 is a variant of the broader CWE-787 (Out-of-bounds Write) and appears on the 2025 CWE Top 25 Most Dangerous Software Weaknesses list. Bugs in this class are almost exclusively introduced during implementation in memory-unsafe languages such as C and C++, which is consistent with what is known of the SAP Kernel's codebase.

In a stack-based buffer overflow, the attacker's data runs past the end of the target buffer and overwrites adjacent stack items. These typically include saved frame pointers and return addresses. By carefully controlling the overflow data, an attacker can redirect execution when the vulnerable function returns, and may achieve arbitrary code execution.

Attack flow

The RFC protocol is SAP's primary mechanism for communication between processes and between systems. RFC listeners accept network connections on well-known ports, and for CVE-2026-27671 the NVD description explicitly states that no authentication is required. The attack proceeds as follows:

1. The attacker finds an SAP system with an RFC listener reachable over the network. RFC services typically listen on predictable port ranges.

2. The attacker builds a malicious RFC request with data designed to exceed the bounds of a stack-allocated buffer in the Kernel's RFC processing code. The NVD description characterizes this as exploiting "logical errors in memory management."

3. The SAP Kernel receives the request and processes it without adequate bounds validation. The oversized data overflows the stack buffer and corrupts adjacent memory, including control flow data such as saved return addresses.

4. The resulting memory corruption has high impact on confidentiality (potential information disclosure from memory), integrity (potential code execution or data manipulation), and availability (potential system crash or denial of service).

Historical RFC attack surface research

This vulnerability sits in a well-documented attack surface. SEC Consult's research, presented at TROOPERS 2023 as "From RFC to RCE 16 Years Later," showed that RFC protocol weaknesses have been a persistent attack vector for over 16 years, and that RFC vulnerabilities can be chained together to achieve full remote code execution on SAP applications.

Research by Andreas Wiegenstein documented that some ABAP-to-Kernel communication paths create buffer overflow risks. The kernel call C_SAPCPARAM can be used to trigger a SAP Kernel buffer overflow via ABAP, and the same path is available remotely via RFC. It is further evidence that the Kernel's handling of RFC-initiated calls has been a recurring source of memory safety violations.

Prior analogous vulnerabilities

CVE-2026-27671 has precedents. The table below lists earlier SAP Kernel and RFC memory corruption vulnerabilities that share key characteristics with it:

CVE-2021-27633 shows how this class of bug plays out. It was a memory corruption vulnerability in the ThCPIC() function of the Disp+work binary, reached through the SAP RFC Gateway service. A malicious RFC packet reached ThrtHdlAppc(), and the inputs were modified and sent to disp+work via ThSAPCMSEND(), which caused a crash. All three of the 2021 CVEs (27597, 27633, 27634) were exploitable remotely without authentication and affected multiple SAP Kernel versions, including 7.22, 7.22EXT, 7.49, 7.53, 7.73, 7.77, 7.81, and 8.04.

Kernel-level impact scope

The flaw is in the SAP Kernel itself rather than in an individual application component, so a successful exploit reaches the base layer of the entire SAP system. Every Application Server ABAP instance running a vulnerable Kernel version is potentially affected, whatever SAP applications are deployed on top of it.

Affected systems and versions

The vulnerability affects the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform. The specific affected Kernel version numbers and minimum patch levels are in SAP Security Note 3717897, which requires SAP Support Portal access to view.

In the prior analogous RFC Kernel vulnerabilities (CVE-2021-27597, CVE-2021-27633, CVE-2021-27634), affected versions spanned multiple Kernel release lines, including 7.22, 7.22EXT, 7.49, 7.53, 7.73, 7.77, 7.81, and 8.04. Organizations should consult SAP Note 3717897 directly to confirm the exact version ranges for CVE-2026-27671.

Vendor security history

SAP SE's vulnerability record gives useful context for evaluating CVE-2026-27671.

SAP has accumulated 834 published CVE records since 2018. Of these, 8 CVEs appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, which confirms that threat actors actively target SAP vulnerabilities in real-world attacks. 54 CVEs have known public exploits available, so exploit code for SAP vulnerabilities is routinely developed and shared.

Before this June disclosure, the 2026 SAP Security Patch Day cycle had already included several critical issues:

Three recent SAP vulnerabilities add context. CVE-2025-31324 was a zero-day in SAP NetWeaver that Onapsis identified as a top SAP vulnerability of 2025, and it showed the persistent risk of unpatched SAP systems. CVE-2025-42989 (CVSS 9.6) was a privilege escalation vulnerability in SAP NetWeaver Application Server for ABAP, caused by inadequate authorization checks during RFC inbound processing. CVE-2025-42976 was a memory corruption vulnerability in the BIC Document component of SAP NetWeaver Application Server ABAP.

RFC-related and Kernel-level memory corruption vulnerabilities have recurred across 2021, 2023, 2025, and now 2026, which shows that SAP's incremental patching approach has not eliminated this vulnerability class at its root. CISA's Secure by Design guidance recommends eliminating it architecturally through memory-safe languages, but SAP's massive C/C++ Kernel codebase makes that a long-term proposition.

References

• NVD: CVE-2026-27671
• SAP Security Note 3717897
• SAP Security Patch Day
• SAP Security Notes & News
• ASUG: What's New From SAP Security Patch June 2026
• CWE-121: Stack-based Buffer Overflow
• CWE-787: Out-of-bounds Write
• Onapsis: SAP Remote Function Call (RFC) Vulnerabilities in 2023
• SEC Consult: From RFC to RCE 16 Years Later (TROOPERS 2023)
• Onapsis: Memory Corruption Vulnerability in SAP NetWeaver Gateway Service
• Risky ABAP to Kernel Communication and ABAP-tunneled Buffer Overflows
• CISA: Secure by Design Alert on Eliminating Buffer Overflow Vulnerabilities
• SAP SE Vulnerabilities: CVEs, CISA KEV & Security Advisories
• Onapsis: Top 2025 SAP Vulnerabilities
• VulnCheck: Quantifying 2026 Routinely Targeted Vulnerabilities