CVE-2026-27689
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HSummary
CVE-2026-27689 is a high-severity Unchecked Input for Loop Condition (CWE-606) vulnerability in Sap (inferred from references). Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-27689, published on 2026-03-10, is an uncontrolled resource consumption vulnerability (CWE-606) that enables a denial-of-service condition in a remote-enabled function module within SAP software. By supplying an excessively large loop-control parameter, the module executes a prolonged loop, consuming excessive system resources and potentially rendering the system unavailable. The vulnerability carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), indicating network accessibility, low attack complexity, and high availability impact with low privileges required.
An authenticated attacker possessing regular user privileges and network access can exploit the vulnerability by repeatedly invoking the affected remote-enabled function module with an oversized loop-control parameter. This triggers resource exhaustion through extended loop execution, leading to a denial-of-service state that disrupts system availability. Confidentiality and integrity are not impacted.
Mitigation details are provided in SAP Note 3719502 (https://me.sap.com/notes/3719502) and on the SAP Security Patch Day page (https://url.sap/sapsecuritypatchday).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10464
Vulnerability Data
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes…
more
excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V17.3.2V4.3.1
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly stops untrusted values from reaching loop conditions without bounds or sanity checks.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and bounds checking that prevent unchecked loop conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect and block unchecked loop conditions before release.
Secure development lifecycle requires input validation and bounds checking that can prevent unchecked loop conditions.
Application security requirements include input validation rules that mitigate excessive looping from untrusted data.
Secure coding standards directly mandate validation of loop-control inputs to prevent unbounded iteration.