{"id":"CVE-2026-76964","kind":"vulnerability","aliases":["CVE-2026-76964"],"related":[],"title":"SAP NetWeaver AS ABAP: unauthenticated memory corruption in Internet Communication Manager allows code execution","description":"SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.","summary":"SAP's CNA record names the Internet Communication Manager (ICM) of SAP NetWeaver AS ABAP. An unauthenticated attacker sending crafted network traffic can trigger memory corruption and run code (CVSS 10.0, CWE-1287). SAP Security Note 3778530 carries the fix; its text is behind SAP login, so fixed kernel patch levels are not confirmed here. No exploitation or public PoC found.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP NetWeaver AS ABAP (Internet Communication Manager)","fixed":[],"affected":"KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20","ecosystem":"vendor"}],"ecosystems":[],"tags":["abap","icm","kernel","netweaver","sap","self-hosted","vendor"],"not_affected_if":["kernel-not-listed","unknown"],"how_to_check":"Check whether your ABAP system runs one of the affected kernels: KRNL64UC/KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 (SM51 > Release Notes, or transaction SMICM > Goto > Parameters shows ICM ports). Then open SAP Security Note 3778530 in SAP for Me for the required kernel patch level. Systems where ICM is not exposed to untrusted networks are lower risk, but the note's own guidance decides.","fix":null,"status":"open","published_at":"2026-11-10T01:17:20+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","triaged_at":"2026-11-10T01:28:06+00:00","updated_at":"2026-11-10T01:30:45+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-10T01:28:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver ABAP: unauthenticated network input flaw lets attackers run code","impact":"high","summary":"SAP NetWeaver Application Server ABAP fails to validate certain network input handled by an internal component, causing memory corruption. An unauthenticated attacker who sends crafted network traffic could execute arbitrary code and fully compromise the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","abap","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code and fully compromises the SAP server","analyst_note":"Find the SAP Security Note and affected support package ranges for CVE-2026-76964 and the vulnerable internal component; NVD alone gives no versions or fix.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"SAP NetWeaver Application Server ABAP installations reachable over the network. The sources do not name affected support package levels or the vulnerable internal component, so teams should check their SAP patch status against the SAP Security Notes.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000695,"input_tokens":4589,"output_tokens":472,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the SAP Security Note and affected support package ranges for CVE-2026-76964 and the vulnerable internal component; NVD alone gives no versions or fix.","search":"'-1287':69B '-2026':16A,19A '-76964':17A,20A '10.0':67B '3778530':73B 'abap':4A,24A,28B,51B,102C 'affect':132C 'allow':12A,137C 'applic':100C 'arbitrari':142C 'as':23A 'attack':54B,117C,139C 'avail':158C 'behind':80B 'carri':74B 'certain':107C 'cna':39B 'code':13A,65B,143C 'communic':10A,44B 'communication':26A 'compon':114C 'compromis':146C 'condit':129C 'confidenti':155C 'confirm':90B 'corrupt':7A,62B,128C 'could':118C,136C 'craft':56B,121C 'cve':15A,18A 'cvss':66B 'cwe':68B 'execut':14A,141C 'exploit':93B,135C 'fix':76B,84B 'found':97B 'fulli':145C 'function':133C 'high':152C 'host':35B 'icm':29B,46B 'impact':153C 'input':109C 'integr':156C 'intern':113C 'internet':9A,25A,43B 'kernel':30B,85B 'level':87B 'login':82B 'manag':11A,45B 'manager':27A 'memori':6A,61B,127C 'name':41B 'netweav':2A,31B,49B,99C 'netweaver':22A 'network':57B,108C,122C 'note':72B 'patch':86B 'poc':96B 'process':110C 'public':95B 'record':40B 'result':149C 'run':64B 'sap':1A,21A,32B,37B,48B,70B,81B,98C 'secur':71B 'self':34B 'self-host':33B 'send':55B,119C 'server':101C 'special':120C 'success':134C 'suffici':105C 'system':148C,161C 'text':78B 'traffic':58B,123C 'trigger':60B,125C 'unauthent':5A,53B,116C 'valid':106C 'vendor':36B","nicknames":[],"mitigations":[],"who_affected":"SAP NetWeaver AS ABAP systems running the Internet Communication Manager (the HTTP/HTTPS/SMTP front end of the ABAP kernel) on kernel releases 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 or 9.20. Per SAP's CVE record no login is needed, only network access to ICM. Systems on other kernel releases are not listed as affected.","tier":"B","verified":{"products":{"at":"2026-11-10T01:30:45Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-76964","run_id":2372},"who_affected":{"at":"2026-11-10T01:30:45Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-76964","run_id":2372}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["netweaverasabapinternetcommunicationmanager","sapnetweaverasabapinternetcommunicationmanager"],"ptokens":["abap","as","communication","internet","manager","netweaver","sap"],"labels":["abap","critical","icm","kernel","netweaver","sap","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':16A,19A '-76964':17A,20A 'abap':4A,24A 'allow':12A 'as':23A 'code':13A 'communic':10A 'communication':26A 'corrupt':7A 'cve':15A,18A 'execut':14A 'internet':9A,25A 'manag':11A 'manager':27A 'memori':6A 'netweav':2A 'netweaver':22A 'sap':1A,21A 'unauthent':5A","search_b":"'-1287':69B '10.0':67B '3778530':73B 'abap':28B,51B 'attack':54B 'behind':80B 'carri':74B 'cna':39B 'code':65B 'communic':44B 'confirm':90B 'corrupt':62B 'craft':56B 'cvss':66B 'cwe':68B 'exploit':93B 'fix':76B,84B 'found':97B 'host':35B 'icm':29B,46B 'internet':43B 'kernel':30B,85B 'level':87B 'login':82B 'manag':45B 'memori':61B 'name':41B 'netweav':31B,49B 'network':57B 'note':72B 'patch':86B 'poc':96B 'public':95B 'record':40B 'run':64B 'sap':32B,37B,48B,70B,81B 'secur':71B 'self':34B 'self-host':33B 'send':55B 'text':78B 'traffic':58B 'trigger':60B 'unauthent':53B 'vendor':36B","search_c":"'abap':102C 'affect':132C 'allow':137C 'applic':100C 'arbitrari':142C 'attack':117C,139C 'avail':158C 'certain':107C 'code':143C 'compon':114C 'compromis':146C 'condit':129C 'confidenti':155C 'corrupt':128C 'could':118C,136C 'craft':121C 'execut':141C 'exploit':135C 'fulli':145C 'function':133C 'high':152C 'impact':153C 'input':109C 'integr':156C 'intern':113C 'memori':127C 'netweav':99C 'network':108C,122C 'process':110C 'result':149C 'sap':98C 'send':119C 'server':101C 'special':120C 'success':134C 'suffici':105C 'system':148C,161C 'traffic':123C 'trigger':125C 'unauthent':116C 'valid':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76964","severity":null,"published_at":"2026-11-10T01:17:20+00:00","modified_at":"2026-11-10T01:17:20+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","fetched_at":"2026-11-10T01:26:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76964:2372","url":"https://cveawg.mitre.org/api/cve/CVE-2026-76964","severity":null,"published_at":"2026-11-10T01:30:45+00:00","modified_at":"2026-11-10T01:30:45+00:00","first_seen_at":"2026-11-10T01:30:45+00:00","fetched_at":"2026-11-10T01:30:45+00:00","note":"SAP CNA record (mitre CVE API) gives component ICM, kernel versions, note 3778530 (login-gated; fixed patch levels not read). Not on Sept/Oct patch day pages; Nov patch day page not yet available. No exploitation seen. Revisit when SAP Nov 2026 patch day page is up.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-76964"]}],"documents":[{"id":112443,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-76964","title":"CVE-2026-76964 CNA record (SAP SE): Memory Corruption in SAP NetWeaver AS ABAP (Internet Communication Manager)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}