CVE-2026-76964

CVE Enrichment

CVSS: 10.0 CRITICAL
CISA KEV: Not listed

Description

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 10-Nov-2026 08:17
Last Modified: 10-Nov-2026 08:17
CWE: CWE-1287

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

SAP_SE · SAP NetWeaver AS ABAP (Internet Communication Manager) Source: CNA · [email protected]
Default status: unaffected

KRNL64UC 7.53 — affected
KERNEL 7.53 — affected
7.54 — affected
7.77 — affected
7.93 — affected
9.16 — affected
9.18 — affected
9.20 — affected

References

Last enrichment sync: 10-Nov-2026 19:10
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

In the ICM flaw (CVE-2026-76964) and the Web Dispatcher flaw (CVE-2026-89126), crafted network traffic could corrupt memory. An attacker who succeeds could then run code and fully compromise the system. SAP Fixes Four Maximum-Severity Flaws, Including Two That Could Enable Remote Code Execution
The company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components. SAP Fixes Four Maximum-Severity Flaws in November Security Update

CVE (7)

MITRE ATT&CK (1)

Vendors (1)

Products (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.