The vulnerability arises from a missing authorization check in SAP NetWeaver Application Server for ABAP, allowing an authenticated user to invoke a specific ABAP function module that can read, modify or insert entries into the database configuration table of the ABAP system. This unauthorized modification can reduce system performance or cause interruptions, representing a low impact on integrity and availability, with no effect on confidentiality.

SAP NetWeaver Application Server for ABAP. No specific product versions are listed in the CNA data, so the vulnerability may affect all currently supported releases of this product.

The CVSS score of 6.4 classifies the issue as medium severity, while the EPSS score of less than 1% indicates a very low probability of exploitation at the time of reporting. The vulnerability is not listed in the CISA KEV catalog. Attacks require legitimate user credentials; therefore, the attack vector is internal or authenticated. An attacker with appropriate access could alter configuration tables, potentially degrading performance or interrupting services, but the scope is limited to the affected system.