CVE-2026-76964— Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)

Quick assessment

Affected

SAP_SE SAP NetWeaver AS ABAP (Internet Communication Manager)

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SAP NetWeaver 应用服务器 ABAP 对其内部组件处理的某些网络输入未进行充分验证。未经身份验证的攻击者可发送特制的网络流量，触发受影响功能中的内存损坏条件。成功利用该漏洞可使攻击者执行任意代码并完全控制系统，从而对系统的机密性、完整性和可用性造成严重影响。

CVSS 10.0 · Critical Updated Nov 10, 2026

Possible ATT&CK Techniques 3 AI

T1068 · Exploitation for Privilege Escalation T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)

Source: CVE Program / CVE List V5

Vulnerability Description

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1287

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
SAP_SE	SAP NetWeaver AS ABAP (Internet Communication Manager)	KRNL64UC 7.53	-

II. Public POCs for CVE-2026-76964

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-76964

请登录查看更多情报信息。

Other References for CVE-2026-76964 (1)

https://me.sap.com/notes/3778530

https://www.cve.org/CVERecord?id=CVE-2026-76964

Same Patch Batch · SAP_SE · 2026-11-10 · 40 CVEs total

CVE-2026-89126	10.0 CRITICAL	Memory Corruption vulnerability in SAP Web Dispatcher
CVE-2026-89103	10.0 CRITICAL	Broken Access Control in SAP Gateway
CVE-2026-120017	10.0 CRITICAL	Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
CVE-2026-109795	9.9 CRITICAL	Missing authorization check in S4CRM
CVE-2026-109803	9.9 CRITICAL	Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms)
CVE-2026-76965	9.9 CRITICAL	OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP P
CVE-2026-89119	9.6 CRITICAL	Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communi
CVE-2026-109798	9.1 CRITICAL	XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platf
CVE-2026-76966	8.9 HIGH	Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
CVE-2026-120008	8.2 HIGH	Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service)
CVE-2026-109800	7.7 HIGH	Memory Corruption vulnerability in SAP Web Dispatcher
CVE-2026-120014	7.6 HIGH	Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communi
CVE-2026-120015	7.5 HIGH	Insufficient Input Validation in SAP Host Agent
CVE-2026-109794	7.5 HIGH	Denial of Service vulnerability in SAP NetWeaver Application Server ABAP, ABAP Platform an
CVE-2026-109793	7.5 HIGH	Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP (Internet C
CVE-2026-109799	7.5 HIGH	Improper verification of JWT signature in IASContextProvider leads to tenant/user identity
CVE-2026-109804	7.5 HIGH	Information Disclosure in SAP NetWeaver (SAP Message Server)
CVE-2026-109806	7.5 HIGH	Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)
CVE-2026-109807	7.5 HIGH	Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)
CVE-2026-89114	7.5 HIGH	Missing Authentication check in SAP NetWeaver AS Java EDM Application

Showing top 20 of 40 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: SAP_SE

Same weakness: CWE-1287