CVE-2019-0349 — SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute “Go to statement” without possessing the authorization S_DEVELOP DEBUG 02, resulting in Missing Authorization Check

Back Back to CVE browser

HIGH

SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute “Go to statement” without possessing the authorization S_DEVELOP DEBUG 02, resulting in Missing Authorization Check

Published Aug 14, 2019

7.2

HIGH

CVSS 3.0

EPSS 1.25%

Description

SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77, allows a user to execute “Go to statement” without possessing the authorization S_DEVELOP DEBUG 02, resulting in Missing Authorization Check

Affected products

Vendor SAP SE Product SAP Kernel (KERNEL) Default
n/a
- Version
  < 7.21
  Status
  affected
  Constraints
  -
- Version
  < 7.49
  Status
  affected
  Constraints
  -
- Version
  < 7.53
  Status
  affected
  Constraints
  -
- Version
  < 7.73
  Status
  affected
  Constraints
  -
- Version
  < 7.75
  Status
  affected
  Constraints
  -
- Version
  < 7.76
  Status
  affected
  Constraints
  -
- Version
  < 7.77
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Kernel (KRNL32NUC) Default
n/a
- Version
  < 7.21
  Status
  affected
  Constraints
  -
- Version
  < 7.21EXT
  Status
  affected
  Constraints
  -
- Version
  < 7.22
  Status
  affected
  Constraints
  -
- Version
  < 7.22EXT
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Kernel (KRNL32UC) Default
n/a
- Version
  < 7.21
  Status
  affected
  Constraints
  -
- Version
  < 7.21EXT
  Status
  affected
  Constraints
  -
- Version
  < 7.22
  Status
  affected
  Constraints
  -
- Version
  < 7.22EXT
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Kernel (KRNL64NUC) Default
n/a
- Version
  < 7.21
  Status
  affected
  Constraints
  -
- Version
  < 7.21EXT
  Status
  affected
  Constraints
  -
- Version
  < 7.22
  Status
  affected
  Constraints
  -
- Version
  < 7.22EXT
  Status
  affected
  Constraints
  -
- Version
  < 7.49
  Status
  affected
  Constraints
  -
Vendor SAP SE Product SAP Kernel (KRNL64UC) Default
n/a
- Version
  < 7.21
  Status
  affected
  Constraints
  -
- Version
  < 7.21EXT
  Status
  affected
  Constraints
  -
- Version
  < 7.22
  Status
  affected
  Constraints
  -
- Version
  < 7.22EXT
  Status
  affected
  Constraints
  -
- Version
  < 7.49
  Status
  affected
  Constraints
  -
- Version
  < 7.73
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

SAP Kernel (KERNEL)

n/a

Version	Status	Constraints
< 7.21	affected	-
< 7.49	affected	-
< 7.53	affected	-
< 7.73	affected	-
< 7.75	affected	-
< 7.76	affected	-
< 7.77	affected	-

SAP SE

SAP Kernel (KRNL32NUC)

n/a

Version	Status	Constraints
< 7.21	affected	-
< 7.21EXT	affected	-
< 7.22	affected	-
< 7.22EXT	affected	-

SAP SE

SAP Kernel (KRNL32UC)

n/a

Version	Status	Constraints
< 7.21	affected	-
< 7.21EXT	affected	-
< 7.22	affected	-
< 7.22EXT	affected	-

SAP SE

SAP Kernel (KRNL64NUC)

n/a

Version	Status	Constraints
< 7.21	affected	-
< 7.21EXT	affected	-
< 7.22	affected	-
< 7.22EXT	affected	-
< 7.49	affected	-

SAP SE

SAP Kernel (KRNL64UC)

n/a

Version	Status	Constraints
< 7.21	affected	-
< 7.21EXT	affected	-
< 7.22	affected	-
< 7.22EXT	affected	-
< 7.49	affected	-
< 7.73	affected	-

Remediation

No remediation recorded yet.

Metrics

1.25% 0.01247

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.01247

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	1.25% (0.01247)	68.25th	v5 (v2026.06.15)
Sep 20, 2026	1.25% (0.01247)	67.98th	v5 (v2026.06.15)
Jul 20, 2024	0.10% (0.00104)	43.04th	v3 (v2023.03.01)
Jun 28, 2024	0.10% (0.00104)	42.91th	v3 (v2023.03.01)
Mar 7, 2023	0.10% (0.00104)	40.90th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Apr 1, 2022	0.89% (0.00885)	24.24th	v2 (v2022.01.01)
Feb 4, 2022	9.03% (0.09029)	86.86th	v2 (v2022.01.01)
Feb 3, 2022	2.74% (0.02742)	63.06th	v1
Jan 6, 2022	2.74% (0.02742)	62.72th	v1
Jan 5, 2022	0.62% (0.00624)	46.35th	v5 (v2026.06.15)
Apr 14, 2021	0.62% (0.00624)	0.00th	v1

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

https://launchpad.support.sap.com/#/notes/2798743
x_refsource_MISCPermissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://launchpad.support.sap.com/#/notes/2798743		x_refsource_MISCPermissions RequiredVendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner sap

Published Aug 14, 2019

Updated Aug 4, 2024

Reserved Nov 26, 2018

Link CVE-2019-0349

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-0349

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-0349