CVE-2026-27685

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27685", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-02-23T17:50:17.028Z", "datePublished": "2026-03-10T00:18:22.023Z", "dateUpdated": "2026-03-11T03:56:31.464Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-03-10T00:18:22.023Z"}, "title": "Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP NetWeaver Enterprise Portal Administration", "versions": [{"status": "affected", "version": "EP-RUNTIME 7.50"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could result in a high impact on the confidentiality, integrity, and availability of the host system.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could result in a high impact on the confidentiality, integrity, and availability of the host system.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3714585"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-27685"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T03:56:31.464Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27685", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T15:39:51.256400Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T15:39:52.377Z"}}], "cna": {"title": "Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP NetWeaver Enterprise Portal Administration", "versions": [{"status": "affected", "version": "EP-RUNTIME 7.50"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3714585"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could result in a high impact on the confidentiality, integrity, and availability of the host system.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could result in a high impact on the confidentiality, integrity, and availability of the host system.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-03-10T00:18:22.023Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27685", "state": "PUBLISHED", "dateUpdated": "2026-03-11T03:56:31.464Z", "dateReserved": "2026-02-23T17:50:17.028Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-03-10T00:18:22.023Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP NetWeaver Enterprise Portal Administration", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "EP-RUNTIME 7.50"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could result in a high impact on the confidentiality, integrity, and availability of the host system."}, {"lang": "es", "value": "La Administraci\u00f3n de SAP NetWeaver Enterprise Portal es vulnerable si un usuario privilegiado carga contenido no confiable o malicioso que, al deserializarse, podr\u00eda resultar en un alto impacto en la confidencialidad, integridad y disponibilidad del sistema anfitri\u00f3n."}], "id": "CVE-2026-27685", "lastModified": "2026-06-17T10:27:30.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27685", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-10T17:38:10.980", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3714585"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "EP-RUNTIME 7.50"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SAP NetWeaver Enterprise Portal Administration", "source": "cna", "vendor": "SAP_SE"}, "product": "sap_netweaver_enterprise_portal_administration", "vendor": "sap_se"}], "analysis": {"en": {"generated_at": "2026-04-16T03:55:34.479650+00:00", "value": {"mitigation_remediation": ["Apply the SAP security patch detailed in SAP Note 3714585 to address the deserialization flaw.", "If a patch cannot be applied immediately, restrict upload functionality for privileged users or remove the ability to upload untrusted content until remediation.", "Implement strict input validation on upload endpoints and use safe deserialization practices to prevent arbitrary code execution."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All installations of SAP NetWeaver Enterprise Portal Administration are potentially affected, as no specific product versions are listed. The issue applies to any environment where privileged users can upload content that is subsequently deserialized by the portal management processes.", "description_and_impact": "The vulnerability in SAP NetWeaver Enterprise Portal Administration allows a privileged user to upload arbitrary content that, when deserialized, may compromise the confidentiality, integrity, and availability of the host system. The insecure deserialization flaw (CWE\u2011502) can enable an attacker to execute arbitrary code or otherwise manipulate the application state, leading to high\u2011impact system compromise.", "risk_and_exploitability": "With a CVSS score of 9.1, the vulnerability is considered critical. However, the current EPSS score indicates a low likelihood of exploitation (<1%). The flaw requires a privileged user to upload malicious content, implying that the attack vector is more likely to be local or insider rather than remote. The vulnerability is not listed in the CISA KEV catalog, so it is not known to be actively exploited in the wild."}}}}, "created": "2026-03-10T14:06:12.761462+00:00", "updated": "2026-04-16T04:00:09.458121+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$sap_netweaver_enterprise_portal_administration"]}