{"id":"CVE-2026-76965","kind":"vulnerability","aliases":["CVE-2026-76965"],"related":[],"title":"SAP NetWeaver ABAP: missing authorization checks let low-privilege users run OS commands (SAP kernel 7.22-9.16)","description":"SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on the underlying host. Successful exploitation could impact resources beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability of the system.","summary":"SAP's CVE record (CVSS 9.9, network, low privileges, scope changed) says the ABAP Application Server skips authorization checks on certain internal functionality, so a low-privilege user can run OS commands on the host. SAP titles it OS Command Injection. Affected: self-managed SAP NetWeaver AS ABAP / ABAP Platform systems on the listed kernel releases; any low-privilege account that can reach the system is enough. Teams with no on-premise ABAP systems can skip it. Exploitation in the wild: none seen in what I read.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP NetWeaver AS ABAP and ABAP Platform kernel","fixed":[],"affected":"KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.53; KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16","ecosystem":"vendor"}],"ecosystems":[],"tags":["abap","abap-platform","kernel","netweaver","sap","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"Check your SAP kernel release (SM51, or System > Status) against: KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16. Fixed patch levels are in SAP Note 3792735 (me.sap.com, login needed); I could not read it.","fix":null,"status":"open","published_at":"2026-11-10T01:17:20+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","triaged_at":"2026-11-10T01:28:10+00:00","updated_at":"2026-11-10T01:30:55+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-10T01:28:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"SAP NetWeaver ABAP: missing authorization checks let low-privilege users run OS commands","impact":"high","summary":"SAP NetWeaver Application Server ABAP and ABAP Platform skips necessary authorization checks on certain internal functionality. An attacker with low privileges can invoke it to execute arbitrary operating system commands on the host.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","abap"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary OS commands on the underlying SAP host","analyst_note":"Check SAP Security Notes for CVE-2026-76965 to find affected releases, fixed patch levels and the vulnerable internal functionality; the NVD entry alone gives no versions or checks.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations running SAP NetWeaver Application Server ABAP or ABAP Platform are exposed to this flaw. The sources do not name the affected release ranges or the specific internal functionality involved, so unknown which configurations are vulnerable.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000699,"input_tokens":4589,"output_tokens":481,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check SAP Security Notes for CVE-2026-76965 to find affected releases, fixed patch levels and the vulnerable internal functionality; the NVD entry alone gives no versions or checks.","search":"'-2026':20A,23A '-76965':21A,24A '-9.16':18A '7.22':17A '9.9':49B 'abap':3A,28A,30A,33B,35B,57B,93B,94B,120B,139C,141C 'abap-platform':34B 'account':106B 'affect':86B,160C 'and':29A 'applic':58B,137C 'arbitrari':164C 'as':27A 'attack':154C 'author':5A,61B,147C 'avail':190C 'beyond':177C 'certain':64B,150C 'chang':54B 'check':6A,62B,148C 'command':14A,76B,84B,167C 'compon':180C 'confidenti':187C 'could':158C,174C 'cve':19A,22A,46B 'cvss':48B 'enough':113B 'execut':163C 'exploit':125B,173C 'function':66B,152C,161C 'high':184C 'host':42B,79B,171C 'impact':175C,185C 'inject':85B 'integr':188C 'intern':65B,151C 'invok':159C 'kernel':16A,32A,37B,100B 'let':7A 'list':99B 'low':9A,51B,70B,104B,156C 'low-privileg':8A,69B,103B 'manag':89B 'miss':4A 'necessari':146C 'netweav':2A,38B,91B,136C 'netweaver':26A 'network':50B 'none':129B 'on-premis':117B 'oper':165C 'os':13A,75B,83B 'perform':145C 'platform':31A,36B,95B,142C 'premis':119B 'privileg':10A,52B,71B,105B,157C 'reach':109B 'read':134B 'record':47B 'releas':101B 'resourc':176C 'result':181C 'run':12A,74B 'sap':1A,15A,25A,39B,44B,80B,90B,135C 'say':55B 'scope':53B 'seen':130B 'self':41B,88B 'self-host':40B 'self-manag':87B 'server':59B,138C 'skip':60B,123B 'success':172C 'system':96B,111B,121B,166C,193C 'team':114B 'titl':81B 'under':170C 'user':11A,72B 'vendor':43B 'vulner':179C 'wild':128B","nicknames":[],"mitigations":[],"who_affected":"Organisations running SAP NetWeaver Application Server ABAP or ABAP Platform are exposed to this flaw. The sources do not name the affected release ranges or the specific internal functionality involved, so unknown which configurations are vulnerable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["netweaverasabapandabapplatformkernel","sapnetweaverasabapandabapplatformkernel"],"ptokens":["abap","and","as","kernel","netweaver","platform","sap"],"labels":["abap","abapplatform","critical","kernel","netweaver","sap","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':20A,23A '-76965':21A,24A '-9.16':18A '7.22':17A 'abap':3A,28A,30A 'and':29A 'as':27A 'author':5A 'check':6A 'command':14A 'cve':19A,22A 'kernel':16A,32A 'let':7A 'low':9A 'low-privileg':8A 'miss':4A 'netweav':2A 'netweaver':26A 'os':13A 'platform':31A 'privileg':10A 'run':12A 'sap':1A,15A,25A 'user':11A","search_b":"'9.9':49B 'abap':33B,35B,57B,93B,94B,120B 'abap-platform':34B 'account':106B 'affect':86B 'applic':58B 'author':61B 'certain':64B 'chang':54B 'check':62B 'command':76B,84B 'cve':46B 'cvss':48B 'enough':113B 'exploit':125B 'function':66B 'host':42B,79B 'inject':85B 'intern':65B 'kernel':37B,100B 'list':99B 'low':51B,70B,104B 'low-privileg':69B,103B 'manag':89B 'netweav':38B,91B 'network':50B 'none':129B 'on-premis':117B 'os':75B,83B 'platform':36B,95B 'premis':119B 'privileg':52B,71B,105B 'reach':109B 'read':134B 'record':47B 'releas':101B 'run':74B 'sap':39B,44B,80B,90B 'say':55B 'scope':53B 'seen':130B 'self':41B,88B 'self-host':40B 'self-manag':87B 'server':59B 'skip':60B,123B 'system':96B,111B,121B 'team':114B 'titl':81B 'user':72B 'vendor':43B 'wild':128B","search_c":"'abap':139C,141C 'affect':160C 'applic':137C 'arbitrari':164C 'attack':154C 'author':147C 'avail':190C 'beyond':177C 'certain':150C 'check':148C 'command':167C 'compon':180C 'confidenti':187C 'could':158C,174C 'execut':163C 'exploit':173C 'function':152C,161C 'high':184C 'host':171C 'impact':175C,185C 'integr':188C 'intern':151C 'invok':159C 'low':156C 'necessari':146C 'netweav':136C 'oper':165C 'perform':145C 'platform':142C 'privileg':157C 'resourc':176C 'result':181C 'sap':135C 'server':138C 'success':172C 'system':166C,193C 'under':170C 'vulner':179C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76965","severity":null,"published_at":"2026-11-10T01:17:20+00:00","modified_at":"2026-11-10T01:17:20+00:00","first_seen_at":"2026-11-10T01:26:41+00:00","fetched_at":"2026-11-10T01:26:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76965:2371","url":"https://cveawg.mitre.org/api/cve/CVE-2026-76965","severity":null,"published_at":"2026-11-10T01:30:55+00:00","modified_at":"2026-11-10T01:30:55+00:00","first_seen_at":"2026-11-10T01:30:55+00:00","fetched_at":"2026-11-10T01:30:55+00:00","note":"Read SAP CNA CVE record (affected kernels, CVSS 9.9, note 3792735). Not on Sept/Oct patch-day pages; SAP note needs login, so fix levels unknown and nothing marked verified. X not checked.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-76965","https://vuldb.com/cve/CVE-2026-76965"]}],"documents":[{"id":112444,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-76965","title":"CVE-2026-76965 CVE record (SAP CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":112445,"url":"https://vuldb.com/cve/CVE-2026-76965","title":"VulDB entry CVE-2026-76965","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}