Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-76965

Missing auth check allows OS command execution in SAP NetWeaver ABAP

CVSS 3.1
9.9 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-76965 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP NetWeaver Application Server ABAP and ABAP Platform skip required authorization checks on certain internal functionality. A low-privileged attacker can invoke that functionality over the network, without user interaction, and run arbitrary operating system commands on the host. Impact can extend beyond the vulnerable component and affect confidentiality, integrity, and availability of the system.

What to do: Apply SAP's update for CVE-2026-76965. SAP has not listed a fixed version or workaround.

ProductAffected
SAP NetWeaver Application Server ABAP and ABAP Platform—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on the underlying host. Successful exploitation could impact resources beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability of the system.

Weakness
CWE-749
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

3 stories