CVE-2026-27685: SAP NetWeaver Enterprise Portal deserialization of untrusted data
The short version: SAP NetWeaver Enterprise Portal Administration has an insecure-deserialization flaw (CVE-2026-27685): a privileged user who uploads untrusted content can trigger deserialization that compromises the host's confidentiality, integrity, and availability. The impact is high, but it requires a privileged account and — unlike some of its NetWeaver siblings — it isn't in CISA's KEV catalog and isn't known to be exploited yet. Steady hands: patch it in your normal SAP Security Patch Day cycle, and keep the portal off the open internet.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Low — high impact, but gated behind privileged access and not yet exploited |
| CVSS v3.1 (CNA — SAP SE) | 9.1 — Critical · AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (NVD analysis pending) |
| EPSS | 0.55% · 42nd percentile (2026-07-17) |
| In CISA KEV? | No — not listed at time of writing |
| Known exploited? | Not at time of writing |
| Vulnerability type | CWE-502 deserialization of untrusted data → compromise of host confidentiality, integrity, availability |
| Requires authenticated session? | Yes — a privileged user is required |
| Affected | SAP NetWeaver Enterprise Portal Administration (EP-RUNTIME 7.50) |
| Fixed in | Per SAP Security Note 3714585 — apply the corresponding SAP Security Patch Day fixes |
What you need to know
The Enterprise Portal Administration component accepts content that it later deserializes. When that deserialization isn't safely constrained, uploaded content can be turned into attacker-controlled objects and, from there, code execution on the SAP host — a full CIA-triad compromise.
The important qualifier is the precondition: exploitation requires a privileged user. This is not a pre-authentication, spray-it-across-the-internet bug. That, plus the absence (at time of writing) of any KEV listing or public evidence of exploitation and a low EPSS, is what separates it from the NetWeaver flaws that have been chained for unauthenticated RCE.
- The impact ceiling is high. SAP NetWeaver is a core business platform; deserialization-to-RCE there is serious wherever it lands.
- The likelihood is currently lower. Needing a privileged account raises the bar, and there's no confirmed in-the-wild use yet — though privileged access can be obtained through other means, so this shouldn't be ignored.
How serious we see it
Low — impact-led, likelihood-tempered.
SAP rates the raw CVSS as Critical (9.1), and the impact justifies that on paper. We land on High for the practical picture: the privileged-access requirement and the lack of known exploitation lower the immediate urgency relative to the KEV-listed NetWeaver bugs. That's not a reason to defer indefinitely — insider risk and credential theft are real, and deserialization flaws age into exploit chains. The reassuring part is that SAP has published a fix and the affected component is specific.
Recommendations
Straight from SAP's guidance:
- Patch on-cycle. Apply SAP's fix per Security Note 3714585 during your SAP Security Patch Day maintenance.
- Keep the portal off the open internet. Restrict Enterprise Portal administration to trusted networks or a VPN.
- Tighten privileged access. Enforce least privilege and MFA on SAP administrative roles; the flaw depends on a privileged account, so protect those accounts accordingly.
- Monitor administrative uploads. Watch for anomalous content uploads and unexpected activity in the portal admin component.
- Confirm your exposure first. Verify whether you run NetWeaver Enterprise Portal (EP-RUNTIME 7.50) and whether it's internet-facing.
How BreachRisk sees it
BreachRisk discovers internet-facing SAP NetWeaver instances from little more than your domain, fingerprints the product, and flags exposure tied to this vulnerability. Because it requires a privileged account, BreachRisk's role here is discovery and prioritization — mapping the exposed portal and flagging the affected version — rather than demonstrating exploitation. When a flaw's urgency depends on exposure, knowing exactly which internet-facing SAP systems are affected is what lets you sequence the patch sensibly rather than guess.