CVE-2026-76973 PUBLISHED

Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (SAP Message Server)

Assigner: sap
Reserved: 20.08.2026 Published: 10.11.2026 Updated: 10.11.2026

Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Product Status

Vendor SAP_SE
Product SAP NetWeaver and ABAP Platform (SAP Message Server)
Versions Default: unaffected
  • Version KRNL64NUC 7.22 is affected
  • Version 7.22EXT is affected
  • Version KRNL64UC 7.22 is affected
  • Version 7.53 is affected
  • Version 8.04 is affected
  • Version KERNEL 7.22 is affected
  • Version 7.54 is affected
  • Version 7.77 is affected
  • Version 7.93 is affected
  • Version 9.16 is affected
  • Version 9.18 is affected
  • Version 9.20 is affected
  • Version 9.21 is affected

References

Problem Types