Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-76964

Unauthenticated memory corruption RCE in SAP NetWeaver AS ABAP

CVSS 3.1
10.0 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-76964 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input handled by an internal component. An unauthenticated attacker can send crafted network traffic and trigger memory corruption. Successful exploitation can run arbitrary code and fully compromise confidentiality, integrity, and availability. Systems running the affected ABAP server component are at risk.

What to do: Apply SAP's update for CVE-2026-76964. SAP has not listed a fixed version or workaround.

ProductAffected
SAP NetWeaver Application Server ABAP—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

Weakness
CWE-1287
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

6 stories