CVE-2026-66767

SAP NetWeaver Application Server for ABAP and ABAP Platform contains an unauthenticated session-hijacking flaw (CWE-191, incorrect type validation) in which a specially crafted network packet causes the server to reprocess a previously buffered user request. Because the flaw can only be triggered under narrow timing conditions, an unauthenticated remote attacker may be able to replay another user's buffered request and take over that user's session, gaining high-impact access to the victim's confidentiality and integrity with only low impact on availability. Any organization running SAP NetWeaver AS for ABAP or ABAP Platform is potentially affected, though the attack surface depends on whether the affected service is reachable from untrusted networks. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known; EPSS currently estimates only a 0.3% probability of exploitation within 30 days.

What to do: Apply the SAP September 2026 Security Patch Day corrections for NetWeaver AS for ABAP and ABAP Platform, using SAP's advisory to identify the note and patch level matching your installed releases. Until patched, restrict network access to the affected SAP application server services from untrusted networks, and monitor for anomalous session reuse or unexpected session takeover. Given the high attack complexity and lack of known exploitation, prioritize patching within normal monthly maintenance windows unless the service is internet-exposed.