---
id: "CVE-2026-120010"
page: "https://infrastack.ai/live/CVE-2026-120010"
kind: "vulnerability"
aliases: ["CVE-2026-120010"]
title: "SAP NetWeaver Message Server: crafted HTTP request crashes service, no code execution"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "SAP NetWeaver Application Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "SAP NetWeaver Application Server (Message Server)", "fixed": [], "affected": "KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.53; KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20, 9.21 (per CVE record mirror, unconfirmed)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dos", "runtime", "sap-kernel", "sap-message-server", "sap-netweaver", "unauthenticated"]
not_affected_if: ["network-restricted-message-server", "unknown"]
published_at: "2026-11-10T01:17:16+00:00"
first_seen_at: "2026-11-10T01:26:39+00:00"
updated_at: "2026-11-10T01:33:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120010", "first_seen_at": "2026-11-10T01:26:39+00:00"}, {"source": "analyst", "url": "https://hol.org/guard/security/cves/CVE-2026-120010-memory-corruption-vulnerability-in-sap-netweaver", "first_seen_at": "2026-11-10T01:33:58+00:00", "cites": ["https://hol.org/guard/security/cves/CVE-2026-120010-memory-corruption-vulnerability-in-sap-netweaver", "https://nvd.nist.gov/vuln/detail/CVE-2026-120010"]}]
exploit_sources: []
---

# SAP NetWeaver Message Server: crafted HTTP request crashes service, no code execution

Link for people: https://infrastack.ai/live/CVE-2026-120010 (this .md is for agents)

SAP NetWeaver Application Server's Message Server mishandles memory sizing on certain HTTP requests, causing a heap buffer overflow. An unauthenticated attacker can make the component abort and stay down until the framework restarts it, with no stated impact on confidentiality or integrity.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver Application Server affected range not listed fixed no fixed version listed
- vendor:SAP NetWeaver Application Server (Message Server) affected KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.53; KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20, 9.21 (per CVE record mirror, unconfirmed) fixed no fixed version listed

## How to check

Check your SAP kernel release (SM51 or 'disp+work -V'). The CVE record lists KRNL64NUC 7.22/7.22EXT, KRNL64UC 7.22/7.53, KERNEL 7.22/7.54/7.77/7.93/9.16/9.18/9.20/9.21 as affected (from a mirror, unconfirmed). Also check whether the Message Server HTTP port (default 81NN, set by ms/server_port_0 / ms/http_port) is reachable from untrusted networks. Open SAP Note 3805570 for the exact patch levels.

## Fix

Apply SAP Security Note 3805570 (https://me.sap.com/notes/3805570); fixed kernel patch levels are not readable without an SAP login.

## Timeline

- 2026-11-10T01:26:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120010
- 2026-11-10T01:33:58+00:00 analyst https://hol.org/guard/security/cves/CVE-2026-120010-memory-corruption-vulnerability-in-sap-netweaver — SAP Security Note 3805570 (Nov 2026 patch day, login-gated at me.sap.com) is the primary; not readable here. Affected kernel list is from a HOL mirror of the CVE record, not SAP's page, so nothing is verified. Fixed kernel patch levels unknown; they are in the note. Not exploited per sources. CWE-131, CVSS 7.5, AV:N/PR:N, availability only.

## Documents

- [describes] HOL Guard: CVE-2026-120010 (mirror of CVE List record) https://hol.org/guard/security/cves/CVE-2026-120010-memory-corruption-vulnerability-in-sap-netweaver
- [describes] NVD: CVE-2026-120010 https://nvd.nist.gov/vuln/detail/CVE-2026-120010

## From the sources

SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality. Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on availability of the system. There is no impact on confidentiality and integrity of the application.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_