Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-76965: SAP NetWeaver ABAP can run OS commands
CVE-2026-76965 · published today
Summary
The SAP NetWeaver Application Server ABAP and ABAP Platform do not check a user's permission before running certain internal functions. This lets even a low‑privilege user start any command on the server’s operating system, potentially exposing or damaging data and services. Apply SAP’s security patches promptly and restrict user rights to only what is needed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sap_se | sap netweaver and abap platform | KRNL64NUC 7.22 |
Original advisory text
OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP Platform
SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on the underlying host. Successful exploitation could impact resources beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability of the system.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-749Exposed Dangerous Method or Function
Timeline
Published10 Nov 2026
Updated10 Nov 2026
First seen10 Nov 2026
Track software like this
Free during beta