CVE-2026-27675

{
  "id": "CVE-2026-27675",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-14T00:16:05.823",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Landscape Transformation contains a vulnerability in an RFC-exposed function module that could allow a high privileged adversary to inject arbitrary ABAP code and operating system commands. Due to this, some information could be modified, but the attacker does not have control over kind or degree. This leads to a low impact on integrity, while confidentiality and availability are not impacted."
    },
    {
      "lang": "es",
      "value": "SAP Landscape Transformation contiene una vulnerabilidad en un módulo de función expuesto por RFC que podría permitir a un adversario con altos privilegios inyectar código ABAP arbitrario y comandos del sistema operativo. Debido a esto, se podría modificar cierta información, pero el atacante no tiene control sobre el tipo o el grado. Esto conlleva a un impacto bajo en la integridad, mientras que la confidencialidad y la disponibilidad no se ven afectadas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Landscape Transformation",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "DMIS 2011_1_700",
              "status": "affected"
            },
            {
              "version": "2011_1_710",
              "status": "affected"
            },
            {
              "version": "2011_1_730",
              "status": "affected"
            },
            {
              "version": "2011_1_731",
              "status": "affected"
            },
            {
              "version": "2011_1_752",
              "status": "affected"
            },
            {
              "version": "2020",
              "status": "affected"
            },
            {
              "version": "S4CORE 102",
              "status": "affected"
            },
            {
              "version": "103",
              "status": "affected"
            },
            {
              "version": "104",
              "status": "affected"
            },
            {
              "version": "105",
              "status": "affected"
            },
            {
              "version": "106",
              "status": "affected"
            },
            {
              "version": "107",
              "status": "affected"
            },
            {
              "version": "108",
              "status": "affected"
            },
            {
              "version": "109",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
          "baseScore": 2.0,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-14T12:55:15.514456Z",
          "id": "CVE-2026-27675",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://me.sap.com/notes/3723097",
      "source": "[email protected]"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "[email protected]"
    }
  ]
}