Security readout for executives and security teams
Plain-English summary
This CVE affects SAP NetWeaver AS ABAP and ABAP Platform. The system may represent internal and external RFC users inconsistently, creating an authentication weakness. If exploitable in a given environment, an unauthenticated network attacker could gain illegitimate system access with high impact to confidentiality, integrity, and availability.
Executive priority
Treat this as a high-priority SAP platform risk. The business concern is unauthorized access to core SAP systems, not a narrow application bug. Prioritize confirmation and vendor-guided remediation for affected ABAP environments.
Technical view
CVE-2021-27610 is an improper authentication issue tied to inconsistent RFC user information formatting in SAP NetWeaver AS ABAP and ABAP Platform versions 700 through 755 and 804. CVSS v3.0 is 9.0, network-accessible, no privileges or user interaction required, high complexity, and scope changed.
Likely exposure
Exposure is likely in organizations running the affected SAP ABAP platform versions, especially where RFC connectivity crosses trust boundaries or is reachable from less-trusted networks. The supplied sources do not identify specific modules, configurations, or public internet exposure requirements.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation is rated high complexity, but the potential impact is severe because successful abuse may grant illegitimate access to SAP systems.
Researcher notes
Public detail is limited in the supplied bundle. The key technical clue is inconsistent internal versus external RFC user representation leading to improper authentication. Avoid assuming exploitability without SAP Note context and environment-specific RFC trust analysis.
Mitigation direction
- Review SAP Note 3007182 for applicability and vendor remediation guidance.
- Apply SAP-provided corrections or support package instructions when confirmed applicable.
- Prioritize systems with RFC connectivity across network or trust boundaries.
- Restrict RFC access to required trusted systems while remediation is assessed.
- Monitor SAP guidance for updated instructions or affected-version clarification.
Validation and detection
- Inventory SAP NetWeaver AS ABAP and ABAP Platform versions in use.
- Check whether versions 700 through 755 or 804 are present.
- Verify SAP Note 3007182 implementation or correction status for each system.
- Review RFC user configuration and trust boundaries for affected systems.
- Confirm no unsupported exposure paths exist for RFC-related access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-27610 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H2.26Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
9CriticalVector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999CVE reference · x_refsource_MISC
- https://launchpad.support.sap.com/#/notes/3007182CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.