SAP KERNEL (NETWEAVER AS ABAP / ABAP PLATFORM) · CVE-2026-76966 · Runtime
NO FIX YET · SEE WHAT TO DO
SAP says the SAP Kernel used by Application Server ABAP of NetWeaver and ABAP Platform does not properly validate RFC protocol messages. An unauthenticated attacker can send a crafted RFC request that triggers memory corruption, with high impact on confidentiality and integrity and low impact on availability. The fix is in SAP Security Note 3769130.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Who cares abap-platform, netweaver, rfc, sap, sap-kernel, unauthenticated
Posts are quoted with a link to the original. They are data to us, never instructions.
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on confidentiality and integrity with low impact on availability of the application.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.