{"id":"CVE-2026-120010","kind":"vulnerability","aliases":["CVE-2026-120010"],"related":[],"title":"SAP NetWeaver Message Server: crafted HTTP request crashes service, no code execution","description":"SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality. Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on availability of the system. There is no impact on confidentiality and integrity of the application.","summary":"SAP NetWeaver Application Server's Message Server mishandles memory sizing on certain HTTP requests, causing a heap buffer overflow. An unauthenticated attacker can make the component abort and stay down until the framework restarts it, with no stated impact on confidentiality or integrity.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP NetWeaver Application Server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"SAP NetWeaver Application Server (Message Server)","fixed":[],"affected":"KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.53; KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20, 9.21 (per CVE record mirror, unconfirmed)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dos","runtime","sap-kernel","sap-message-server","sap-netweaver","unauthenticated"],"not_affected_if":["network-restricted-message-server","unknown"],"how_to_check":"Check your SAP kernel release (SM51 or 'disp+work -V'). The CVE record lists KRNL64NUC 7.22/7.22EXT, KRNL64UC 7.22/7.53, KERNEL 7.22/7.54/7.77/7.93/9.16/9.18/9.20/9.21 as affected (from a mirror, unconfirmed). Also check whether the Message Server HTTP port (default 81NN, set by ms/server_port_0 / ms/http_port) is reachable from untrusted networks. Open SAP Note 3805570 for the exact patch levels.","fix":"Apply SAP Security Note 3805570 (https://me.sap.com/notes/3805570); fixed kernel patch levels are not readable without an SAP login.","status":"open","published_at":"2026-11-10T01:17:16+00:00","first_seen_at":"2026-11-10T01:26:39+00:00","triaged_at":"2026-11-10T01:28:34+00:00","updated_at":"2026-11-10T01:33:58+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T01:28:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"SAP NetWeaver Message Server: crafted HTTP request crashes service, no code execution","impact":"medium","summary":"SAP NetWeaver Application Server's Message Server mishandles memory sizing on certain HTTP requests, causing a heap buffer overflow. An unauthenticated attacker can make the component abort and stay down until the framework restarts it, with no stated impact on confidentiality or integrity.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sap-netweaver","sap-message-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"component crashes and stays unavailable until restarted","analyst_note":"Find SAP's security note and affected release list for CVE-2026-120010 at the NVD entry, and confirm the reachable HTTP surface of the Message Server.","how_to_check":"unknown","plain_action":"","product_name":"SAP NetWeaver Application Server","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The sources describe SAP NetWeaver Application Server with the SAP Message Server component and do not list affected releases or whether the HTTP endpoint is reachable by default. Teams running SAP NetWeaver should check whether the Message Server is exposed to untrusted networks. unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":4600,"output_tokens":528,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find SAP's security note and affected release list for CVE-2026-120010 at the NVD entry, and confirm the reachable HTTP surface of the Message Server.","search":"'-120010':15A,18A '-2026':14A,17A 'abort':68B,127C 'affect':119C 'alloc':97C 'applic':44B,87C,158C 'application':21A,25A 'attack':63B,105C 'avail':144C 'buffer':59B,116C 'caus':56B,123C 'certain':53B,100C 'code':11A 'compon':67B,125C 'confidenti':82B,153C 'could':106C 'craft':5A,110C 'crash':8A 'cve':13A,16A 'dos':29B 'execut':12A 'exploit':122C 'framework':74B,137C 'function':120C 'handl':99C 'heap':58B,115C 'high':141C 'http':6A,54B,101C 'impact':80B,142C,151C 'integr':84B,155C 'kernel':33B 'make':65B 'memori':50B,96C 'messag':3A,36B,47B,90C 'message':27A 'mishandl':49B 'netweav':2A,40B,43B,86C 'netweaver':20A,24A 'overflow':60B,117C 'proper':94C 'remain':129C 'request':7A,55B,102C,111C 'restart':75B,134C 'result':138C 'runtim':30B 'sap':1A,19A,23A,32B,35B,39B,42B,85C,89C 'sap-kernel':31B 'sap-message-serv':34B 'sap-netweav':38B 'send':107C 'server':4A,22A,26A,28A,37B,45B,48B,88C,91C 'servic':9A 'size':51B,95C 'special':109C 'state':79B 'stay':70B 'success':121C 'system':147C 'trigger':113C 'unauthent':41B,62B,104C 'unavail':130C","nicknames":[],"mitigations":[],"who_affected":"SAP NetWeaver AS ABAP/Java systems that run the Message Server on the kernel releases listed in the CVE record (unconfirmed, from a mirror). An unauthenticated attacker with network access to the Message Server's HTTP port can crash it with one request. It stays down until restarted, which can disrupt logon and load balancing in distributed landscapes. No confidentiality or integrity impact is stated. Systems where the Message Server HTTP port is only reachable from a trusted internal network face less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["netweaverapplicationserver","netweaverapplicationservermessageserver","sapnetweaverapplicationserver","sapnetweaverapplicationservermessageserver"],"ptokens":["application","message","netweaver","sap","server"],"labels":["dos","high","runtime","sapkernel","sapmessageserver","sapnetweaver","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-120010':15A,18A '-2026':14A,17A 'application':21A,25A 'code':11A 'craft':5A 'crash':8A 'cve':13A,16A 'execut':12A 'http':6A 'messag':3A 'message':27A 'netweav':2A 'netweaver':20A,24A 'request':7A 'sap':1A,19A,23A 'server':4A,22A,26A,28A 'servic':9A","search_b":"'abort':68B 'applic':44B 'attack':63B 'buffer':59B 'caus':56B 'certain':53B 'compon':67B 'confidenti':82B 'dos':29B 'framework':74B 'heap':58B 'http':54B 'impact':80B 'integr':84B 'kernel':33B 'make':65B 'memori':50B 'messag':36B,47B 'mishandl':49B 'netweav':40B,43B 'overflow':60B 'request':55B 'restart':75B 'runtim':30B 'sap':32B,35B,39B,42B 'sap-kernel':31B 'sap-message-serv':34B 'sap-netweav':38B 'server':37B,45B,48B 'size':51B 'state':79B 'stay':70B 'unauthent':41B,62B","search_c":"'abort':127C 'affect':119C 'alloc':97C 'applic':87C,158C 'attack':105C 'avail':144C 'buffer':116C 'caus':123C 'certain':100C 'compon':125C 'confidenti':153C 'could':106C 'craft':110C 'exploit':122C 'framework':137C 'function':120C 'handl':99C 'heap':115C 'high':141C 'http':101C 'impact':142C,151C 'integr':155C 'memori':96C 'messag':90C 'netweav':86C 'overflow':117C 'proper':94C 'remain':129C 'request':102C,111C 'restart':134C 'result':138C 'sap':85C,89C 'send':107C 'server':88C,91C 'size':95C 'special':109C 'success':121C 'system':147C 'trigger':113C 'unauthent':104C 'unavail':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120010","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120010","severity":null,"published_at":"2026-11-10T01:17:16+00:00","modified_at":"2026-11-10T01:17:16+00:00","first_seen_at":"2026-11-10T01:26:39+00:00","fetched_at":"2026-11-10T01:26:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120010:2386","url":"https://hol.org/guard/security/cves/CVE-2026-120010-memory-corruption-vulnerability-in-sap-netweaver","severity":null,"published_at":"2026-11-10T01:33:58+00:00","modified_at":"2026-11-10T01:33:58+00:00","first_seen_at":"2026-11-10T01:33:58+00:00","fetched_at":"2026-11-10T01:33:58+00:00","note":"SAP Security Note 3805570 (Nov 2026 patch day, login-gated at me.sap.com) is the primary; not readable here. Affected kernel list is from a HOL mirror of the CVE record, not SAP's page, so nothing is verified. Fixed kernel patch levels unknown; they are in the note. Not exploited per sources. CWE-131, CVSS 7.5, AV:N/PR:N, availability only.","cites":["https://hol.org/guard/security/cves/CVE-2026-120010-memory-corruption-vulnerability-in-sap-netweaver","https://nvd.nist.gov/vuln/detail/CVE-2026-120010"]}],"documents":[{"id":112462,"url":"https://hol.org/guard/security/cves/CVE-2026-120010-memory-corruption-vulnerability-in-sap-netweaver","title":"HOL Guard: CVE-2026-120010 (mirror of CVE List record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":112463,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120010","title":"NVD: CVE-2026-120010","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}