---
id: "CVE-2026-76964"
page: "https://infrastack.ai/live/CVE-2026-76964"
kind: "vulnerability"
aliases: ["CVE-2026-76964"]
title: "SAP NetWeaver AS ABAP: unauthenticated memory corruption in Internet Communication Manager allows code execution"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SAP NetWeaver AS ABAP (Internet Communication Manager)", "fixed": [], "affected": "KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20", "ecosystem": "vendor"}]
ecosystems: []
tags: ["abap", "icm", "kernel", "netweaver", "sap", "self-hosted", "vendor"]
not_affected_if: ["kernel-not-listed", "unknown"]
published_at: "2026-11-10T01:17:20+00:00"
first_seen_at: "2026-11-10T01:26:41+00:00"
updated_at: "2026-11-10T01:30:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76964", "first_seen_at": "2026-11-10T01:26:41+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-76964", "first_seen_at": "2026-11-10T01:30:45+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-76964"]}]
exploit_sources: []
---

# SAP NetWeaver AS ABAP: unauthenticated memory corruption in Internet Communication Manager allows code execution

Link for people: https://infrastack.ai/live/CVE-2026-76964 (this .md is for agents)

SAP's CNA record names the Internet Communication Manager (ICM) of SAP NetWeaver AS ABAP. An unauthenticated attacker sending crafted network traffic can trigger memory corruption and run code (CVSS 10.0, CWE-1287). SAP Security Note 3778530 carries the fix; its text is behind SAP login, so fixed kernel patch levels are not confirmed here. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver AS ABAP (Internet Communication Manager) affected KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 fixed no fixed version listed

## How to check

Check whether your ABAP system runs one of the affected kernels: KRNL64UC/KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 (SM51 > Release Notes, or transaction SMICM > Goto > Parameters shows ICM ports). Then open SAP Security Note 3778530 in SAP for Me for the required kernel patch level. Systems where ICM is not exposed to untrusted networks are lower risk, but the note's own guidance decides.

## Timeline

- 2026-11-10T01:26:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76964
- 2026-11-10T01:30:45+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-76964 — SAP CNA record (mitre CVE API) gives component ICM, kernel versions, note 3778530 (login-gated; fixed patch levels not read). Not on Sept/Oct patch day pages; Nov patch day page not yet available. No exploitation seen. Revisit when SAP Nov 2026 patch day page is up.

## Documents

- [advisory] CVE-2026-76964 CNA record (SAP SE): Memory Corruption in SAP NetWeaver AS ABAP (Internet Communication Manager) https://cveawg.mitre.org/api/cve/CVE-2026-76964

## From the sources

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_