CVE-2026-27689

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3719502
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

17 Jun 2026, 10:27

Type	Values Removed	Values Added
Summary		(es) Debido a una vulnerabilidad de consumo de recursos no controlado (denegación de servicio), un atacante autenticado con privilegios de usuario regular y acceso a la red puede invocar repetidamente un módulo de función habilitado remotamente con un parámetro de control de bucle excesivamente grande. Esto desencadena una ejecución de bucle prolongada que consume recursos excesivos del sistema, lo que podría dejar el sistema no disponible. La explotación exitosa resulta en una condición de denegación de servicio que afecta la disponibilidad, mientras que la confidencialidad y la integridad permanecen inafectadas.

10 Mar 2026, 17:38

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-10 17:38

Updated : 2026-06-17 10:27

NVD link : CVE-2026-27689

Mitre link : CVE-2026-27689

CVE.ORG link : CVE-2026-27689

JSON object : View

Products Affected

No product.

CWE

CWE-606

Unchecked Input for Loop Condition

{"id": "CVE-2026-27689", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27689", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T15:35:53.163951Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Supply Chain Management", "versions": [{"status": "affected", "version": "SCMAPO 713"}, {"status": "affected", "version": "714"}, {"status": "affected", "version": "S4CORE 102"}, {"status": "affected", "version": "103"}, {"status": "affected", "version": "104"}, {"status": "affected", "version": "S4COREOP 105"}, {"status": "affected", "version": "106"}, {"status": "affected", "version": "107"}, {"status": "affected", "version": "108"}, {"status": "affected", "version": "109"}, {"status": "affected", "version": "SCM 700"}, {"status": "affected", "version": "701"}, {"status": "affected", "version": "702"}, {"status": "affected", "version": "712"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-10T17:38:11.683", "references": [{"url": "https://me.sap.com/notes/3719502", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-606"}]}], "descriptions": [{"lang": "en", "value": "Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected."}, {"lang": "es", "value": "Debido a una vulnerabilidad de consumo de recursos no controlado (denegaci\u00f3n de servicio), un atacante autenticado con privilegios de usuario regular y acceso a la red puede invocar repetidamente un m\u00f3dulo de funci\u00f3n habilitado remotamente con un par\u00e1metro de control de bucle excesivamente grande. Esto desencadena una ejecuci\u00f3n de bucle prolongada que consume recursos excesivos del sistema, lo que podr\u00eda dejar el sistema no disponible. La explotaci\u00f3n exitosa resulta en una condici\u00f3n de denegaci\u00f3n de servicio que afecta la disponibilidad, mientras que la confidencialidad y la integridad permanecen inafectadas."}], "lastModified": "2026-06-17T10:27:31.407", "sourceIdentifier": "cna@sap.com"}