CVE-2026-76966— Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
Quick assessment
Affected
SAP_SE SAP NetWeaver and ABAP Platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
由于 SAP NetWeaver 和 ABAP 平台的 ABAP 应用服务器所使用的 SAP Kernel 中 RFC 协议验证不当，未经身份验证的攻击者可发送特制的 RFC 请求，利用内存管理中的逻辑错误，导致内存损坏。这可能对应用的保密性和完整性造成严重影响，而对可用性影响较小。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76966
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
Source: CVE Program / CVE List V5
Vulnerability Description
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on confidentiality and integrity with low impact on availability of the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP NetWeaver and ABAP Platform | KRNL64NUC 7.22 | - |
|
II. Public POCs for CVE-2026-76966
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76966
请登录查看更多情报信息。
Other References for CVE-2026-76966 (1)
Same Patch Batch · SAP_SE · 2026-11-10 · 40 CVEs total
| CVE-2026-89126 | 10.0 CRITICAL | Memory Corruption vulnerability in SAP Web Dispatcher |
| CVE-2026-76964 | 10.0 CRITICAL | Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager) |
| CVE-2026-120017 | 10.0 CRITICAL | Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) |
| CVE-2026-89103 | 10.0 CRITICAL | Broken Access Control in SAP Gateway |
| CVE-2026-109795 | 9.9 CRITICAL | Missing authorization check in S4CRM |
| CVE-2026-109803 | 9.9 CRITICAL | Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms) |
| CVE-2026-76965 | 9.9 CRITICAL | OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP P |
| CVE-2026-89119 | 9.6 CRITICAL | Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communi |
| CVE-2026-109798 | 9.1 CRITICAL | XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platf |
| CVE-2026-120008 | 8.2 HIGH | Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service) |
| CVE-2026-109800 | 7.7 HIGH | Memory Corruption vulnerability in SAP Web Dispatcher |
| CVE-2026-120014 | 7.6 HIGH | Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communi |
| CVE-2026-109807 | 7.5 HIGH | Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service) |
| CVE-2026-109794 | 7.5 HIGH | Denial of Service vulnerability in SAP NetWeaver Application Server ABAP, ABAP Platform an |
| CVE-2026-109793 | 7.5 HIGH | Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP (Internet C |
| CVE-2026-109799 | 7.5 HIGH | Improper verification of JWT signature in IASContextProvider leads to tenant/user identity |
| CVE-2026-109804 | 7.5 HIGH | Information Disclosure in SAP NetWeaver (SAP Message Server) |
| CVE-2026-109806 | 7.5 HIGH | Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service) |
| CVE-2026-120015 | 7.5 HIGH | Insufficient Input Validation in SAP Host Agent |
| CVE-2026-89114 | 7.5 HIGH | Missing Authentication check in SAP NetWeaver AS Java EDM Application |
Showing top 20 of 40 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: SAP NetWeaver and ABAP Platform
-
CVE-2026-109796
Multiple vulnerabilities in Application Server ABAP of SAP N -
CVE-2026-76970
Memory Corruption vulnerability in Application Server ABAP f -
CVE-2026-76965
OS Command Injection vulnerability in ABAP Application Serve -
CVE-2026-76963
Missing Authorization Check in Application Server ABAP of SA -
CVE-2026-34265
Memory Corruption vulnerability in Application Server ABAP f
Same vendor: SAP_SE
-
CVE-2026-109799
Improper verification of JWT signature in IASContextProvider -
CVE-2026-109797
Cross-tenant sandbox takeover in SAP/astonish -
CVE-2026-109805
Weak Cryptography in SAP NetWeaver and ABAP Platform (Applic -
CVE-2026-89125
Insecure Storage of Sensitive Information in SAP Web Dispatc -
CVE-2026-120017
Missing Authentication in SAP NetWeaver AS ABAP and ABAP Pla
Same weakness: CWE-294
-
CVE-2026-123801
SuperTokens Core: SAML callback accepts a replayed RelayStat -
CVE-2026-82907
Apache OFBiz: externalLoginKey honoured pre-auth, reusable a -
CVE-2026-102894
GPUStack: SAML callback trusts an unverified SAMLResponse, a -
CVE-2026-122220
WPO365 LOGIN before 45.2 SAML Replay Protection Bypass -
CVE-2026-121640
WatchGuard AuthPoint Gateway Capture-replay Allows Unauthori