SAP November patch day fixes four CVSS 10.0 flaws
Unauthenticated memory corruption in ICM and Web Dispatcher may allow code execution; exploitation is not discussed.
70
CVE-2026-76973
Unauthenticated memory-corruption DoS in SAP NetWeaver ABAP
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A memory corruption flaw in Application Server ABAP of SAP NetWeaver and ABAP Platform lets an unauthenticated attacker send crafted network requests to the affected service. Triggering it can crash the server and drop active connections, causing denial of service. Confidentiality and integrity are not affected. SAP has not listed affected builds.
What to do: Apply SAP's update for CVE-2026-76973. No workaround is stated.
| Product | Affected |
|---|---|
| SAP Application Server ABAP of SAP NetWeaver | — |
| SAP ABAP Platform | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected.
- Weakness
- CWE-190
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H