Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-76970

Memory corruption DoS in SAP NetWeaver ABAP

CVSS 3.1
7.5 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-76970 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

A memory corruption flaw in the parsing routine of Application Server ABAP for SAP NetWeaver and ABAP Platform lets an unauthenticated remote attacker send crafted requests that crash and restart affected processes. Repeating those requests can sustain a denial of service and hit availability hard. Confidentiality and integrity are not affected.

What to do: Apply SAP's update for CVE-2026-76970. SAP has not listed a fixed version or workaround.

ProductAffected
SAP Application Server ABAP for SAP NetWeaver—
SAP ABAP Platform—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could cause the affected processes to crash and restart. By repeatedly sending such requests, the attacker could cause a sustained denial of service, leading to a high impact on availability. Confidentiality and integrity remain unaffected.

Weakness
CWE-787
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories