---
id: "CVE-2026-76965"
page: "https://infrastack.ai/live/CVE-2026-76965"
kind: "vulnerability"
aliases: ["CVE-2026-76965"]
title: "SAP NetWeaver ABAP: missing authorization checks let low-privilege users run OS commands (SAP kernel 7.22-9.16)"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "SAP NetWeaver AS ABAP and ABAP Platform kernel", "fixed": [], "affected": "KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.53; KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16", "ecosystem": "vendor"}]
ecosystems: []
tags: ["abap", "abap-platform", "kernel", "netweaver", "sap", "self-hosted", "vendor"]
not_affected_if: []
published_at: "2026-11-10T01:17:20+00:00"
first_seen_at: "2026-11-10T01:26:41+00:00"
updated_at: "2026-11-10T01:30:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76965", "first_seen_at": "2026-11-10T01:26:41+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-76965", "first_seen_at": "2026-11-10T01:30:55+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-76965", "https://vuldb.com/cve/CVE-2026-76965"]}]
exploit_sources: []
---

# SAP NetWeaver ABAP: missing authorization checks let low-privilege users run OS commands (SAP kernel 7.22-9.16)

Link for people: https://infrastack.ai/live/CVE-2026-76965 (this .md is for agents)

SAP's CVE record (CVSS 9.9, network, low privileges, scope changed) says the ABAP Application Server skips authorization checks on certain internal functionality, so a low-privilege user can run OS commands on the host. SAP titles it OS Command Injection. Affected: self-managed SAP NetWeaver AS ABAP / ABAP Platform systems on the listed kernel releases; any low-privilege account that can reach the system is enough. Teams with no on-premise ABAP systems can skip it. Exploitation in the wild: none seen in what I read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver AS ABAP and ABAP Platform kernel affected KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.53; KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16 fixed no fixed version listed

## How to check

Check your SAP kernel release (SM51, or System > Status) against: KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16. Fixed patch levels are in SAP Note 3792735 (me.sap.com, login needed); I could not read it.

## Timeline

- 2026-11-10T01:26:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76965
- 2026-11-10T01:30:55+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-76965 — Read SAP CNA CVE record (affected kernels, CVSS 9.9, note 3792735). Not on Sept/Oct patch-day pages; SAP note needs login, so fix levels unknown and nothing marked verified. X not checked.

## Documents

- [advisory] CVE-2026-76965 CVE record (SAP CNA) https://cveawg.mitre.org/api/cve/CVE-2026-76965
- [mentions] VulDB entry CVE-2026-76965 https://vuldb.com/cve/CVE-2026-76965

## From the sources

SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on the underlying host. Successful exploitation could impact resources beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability of the system.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_