Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-76966

Unauthenticated memory corruption via SAP Kernel RFC

CVSS 3.1
8.9 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-76966 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Improper RFC protocol validation in the SAP Kernel, used by Application Server ABAP in SAP NetWeaver and ABAP Platform, allows logical errors in memory management. An unauthenticated remote attacker can send a crafted RFC request and corrupt memory without user interaction. That can expose or alter application data, with limited effect on availability. SAP NetWeaver and ABAP Platform deployments using this kernel are affected; affected builds are not listed.

What to do: Apply SAP's update for CVE-2026-76966. SAP has not listed a fixed version or workaround.

ProductAffected
SAP NetWeaver Application Server ABAP—
SAP ABAP Platform—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on confidentiality and integrity with low impact on availability of the application.

Weakness
CWE-294
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories