Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

SAP NetWeaver AS ABAP allows remote takeover

CVE-2026-76964 · published 1 day ago
Summary

The SAP NetWeaver Application Server ABAP's Internet Communication Manager does not properly check certain data it receives over the network. An attacker who can send specially crafted traffic could cause the server to run their own code, giving them full control of the system. Apply the vendor's security update and limit network access to trusted sources while monitoring for unusual traffic.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sap_se sap netweaver as abap (internet communication manager) KRNL64UC 7.53
Original advisory text
Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-1287Improper Validation of Specified Type of Input
Timeline
Published10 Nov 2026
Updated11 Nov 2026
First seen10 Nov 2026
Sources
CVE-2026-76964 · NVD
CVE-2026-76964 · MITRE
Track software like this
Free during beta