SAP NETWEAVER AS ABAP AND ABAP PLATFORM KERNEL · CVE-2026-76965 · Vendor
NO FIX YET
SAP's CVE record (CVSS 9.9, network, low privileges, scope changed) says the ABAP Application Server skips authorization checks on certain internal functionality, so a low-privilege user can run OS commands on the host. SAP titles it OS Command Injection. Affected: self-managed SAP NetWeaver AS ABAP / ABAP Platform systems on the listed kernel releases; any low-privilege account that can reach the system is enough. Teams with no on-premise ABAP systems can skip it. Exploitation in the wild: none seen in what I read.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations running SAP NetWeaver Application Server ABAP or ABAP Platform are exposed to this flaw. The sources do not name the affected release ranges or the specific internal functionality involved, so unknown which configurations are vulnerable.
Who cares abap, abap-platform, kernel, netweaver, sap, self-hosted
Unknown from the sources.
SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on the underlying host. Successful exploitation could impact resources beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability of the system.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.