Security hole in program ssfrfc on the application server, SAP security note 1438399

SAP Note 1438399SAP Security Note

SAP security note 1438399, “Security hole in program ssfrfc on the application server”, is published by SAP for the affected component listed below. The description reproduces the information SAP released for this note.

ComponentBC-SEC-SSF Secure Store and Forward

Description

Due to a security hole in the program ssfrfc on the application server, malicious users may obtain control of an SAP system.

CVSS

Score 0

Affected components

SAP_BASIS | 46A | 46D
SAP_BASIS | 610 | 640
SAP_BASIS | 700 | 702
SAP_BASIS | 710 | 711
SAP KERNEL 4.6D_EX2 32-BIT | SP2513 | 002513
SAP KERNEL 4.6D_EX2 64-BIT | SP2513 | 002513
SAP KERNEL 4.6D_EXT 32-BIT | SP2513 | 002513
SAP KERNEL 4.6D_EXT 64-BIT | SP2513 | 002513
SAP KERNEL 6.40 32-BIT | SP320 | 000320
SAP KERNEL 7.00 32-BIT | SP245 | 000245
SAP KERNEL 7.00 32-BIT UNICODE | SP245 | 000245
SAP KERNEL 7.00 64-BIT | SP245 | 000245
SAP KERNEL 7.00 64-BIT UNICODE | SP245 | 000245
SAP KERNEL 7.01 32-BIT | SP082 | 000082
SAP KERNEL 7.01 32-BIT UNICODE | SP082 | 000082
SAP KERNEL 7.01 64-BIT | SP082 | 000082
SAP KERNEL 7.01 64-BIT UNICODE | SP082 | 000082
SAP KERNEL 7.10 32-BIT | SP189 | 000189
SAP KERNEL 7.10 32-BIT UNICODE | SP189 | 000189
SAP KERNEL 7.10 64-BIT | SP189 | 000189

Full note on SAP: SAP Support Launchpad note 1438399

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

Explore More

CVE-2026-58240 security alert cover, CVSS base score 9.8 critical, SAP message server missing authentication

SAP Note 3759472: SAP Message Server Authentication Gap (CVE-2026-58240)

September 8, 2026

SAP Note 3759472 CVE-2026-58240 SAP Message Server Patch Day September 2026 SAP Security Note 3759472 | CVSS 3.0 base score 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVE-2026-44756 security alert cover, CVSS base score 10.0 critical, SAP Extended Passport stack overflow

SAP Note 3747649: SAP Extended Passport Overflow (CVE-2026-44756)

September 8, 2026

SAP Note 3747649 CVE-2026-44756 SAP NetWeaver Kernel Patch Day September 2026 SAP Security Note 3747649 | CVSS 3.0 base score 10.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

SAP Security Patch Day September 2026 cover image from RedRays

SAP Security Patch Day September 2026 | RedRays

September 8, 2026

SAP Security Patch Day September 2026 brings 20 security notes, four of them HotNews rated up to CVSS 10.0, alongside five High

SAP Note 3765948 cover image, code injection and SSRF vulnerability analysis of CVE-2026-44772 in SAP MII

SAP Note 3765948: Code Injection via SSRF in SAP MII (CVE-2026-44772)

August 11, 2026

CVE-2026-44772, CVSS 9.9: XSL transform parameters let an authenticated user make SAP MII fetch and execute a remote stylesheet. The gate ships disabled.