A missing authorization check in the SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker to misuse an RFC function to execute form routines (FORMs). Successful exploitation could enable the attacker to write or modify data that is otherwise protected by the form routines and to invoke additional system functionality exposed through these routines, creating a high impact on data integrity and availability while leaving confidentiality largely unaffected.

SAP NetWeaver Application Server ABAP and ABAP Platform across the following Release numbers: 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, and 816. The vulnerability is documented against the SAP Basis component of these products.

The issue carries a CVSS score of 8.1, indicating a high severity. The EPSS score is below 1%, reflecting a low probability of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be online via an authenticated user with access to the vulnerable RFC function; success requires internal authentication or compromise of legitimate user credentials.