Allows an authenticated, low‑privileged user to invoke background remote function calls in SAP NetWeaver Application Server ABAP against the S_RFC authorization boundary. This flaw enables the attacker to modify application data and disrupt service, constituting a high‑impact breach of integrity and availability while preserving confidentiality.

SAP NetWeaver Application Server ABAP and ABAP Platform—specifically kernel versions 7.22, 7.53, 7.54, 7.77, 7.89, 7.93 and 9.16, 9.18, 9.19, along with corresponding 64‑bit non‑Nuclear and 64‑bit NUC variations—are affected.

Given the CVSS base score of 9.6, the exploit is evaluated as highly impactful; the EPSS score of less than 1 % suggests a very low probability of exploitation at this time, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector involves an authenticated session via SAP user credentials, with the attacker leveraging low‑privilege accounts to execute unauthorized background RFCs. The lack of confidentiality impact indicates the flaw primarily harms integrity and availability of the hosted application.