CVE-2025-27428: Due to directory traversal vulnerability, an authorized attacker could gain access to some critical information by using RFC enabled function module. Upon…

PriorityP347high7.7CVSS 3.1

AVNACLPRLUINSCCHINAN

EPSS

0.59%

44.2th percentile

Due to directory traversal vulnerability, an authorized attacker could gain access to some critical information by using RFC enabled function module. Upon successful exploitation, they could read files from any managed system connected to SAP Solution Manager, leading to high impact on confidentiality. There is no impact on integrity or availability.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
sap_se	sap_netweaver_and_abap_platform	—	—
sap_se	sap_netweaver_and_abap_platform	—	—
sap_se	sap_netweaver_and_abap_platform	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.