SAP NETWEAVER AS ABAP (INTERNET COMMUNICATION MANAGER) · CVE-2026-76964 · Vendor
NO FIX YET
SAP's CNA record names the Internet Communication Manager (ICM) of SAP NetWeaver AS ABAP. An unauthenticated attacker sending crafted network traffic can trigger memory corruption and run code (CVSS 10.0, CWE-1287). SAP Security Note 3778530 carries the fix; its text is behind SAP login, so fixed kernel patch levels are not confirmed here. No exploitation or public PoC found.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
SAP NetWeaver AS ABAP systems running the Internet Communication Manager (the HTTP/HTTPS/SMTP front end of the ABAP kernel) on kernel releases 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 or 9.20. Per SAP's CVE record no login is needed, only network access to ICM. Systems on other kernel releases are not listed as affected.
Not affected if kernel-not-listed, unknown
Who cares abap, icm, kernel, netweaver, sap, self-hosted
No fix yet, per the sources.
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.