Tuesday, 31 March, 2026
New SAP NetWeaver Zero-Day RCE Exploit Uses ABAP Backdoors & Dynamic Payloads
By Isha
A sophisticated zero-day exploit targeting SAP NetWeaver’s ICM component enables unauthenticated attackers to achieve remote code execution (RCE) and install stealthy backdoors. The exploit sends crafted HTTP requests to the metadatauploader endpoint, triggering ABAP code injection and buffer overflow. Attackers insert hidden ABAP programs for persistent access and data theft via SQL manipulation. The script masks itself within legitimate SAP logic—making detection extremely difficult.
Read full story at Cybersecurity News