{"id":"CVE-2026-76966","kind":"vulnerability","aliases":["CVE-2026-76966"],"related":[],"title":"SAP NetWeaver ABAP: crafted RFC request corrupts memory, unauthenticated attacker","description":"Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on confidentiality and integrity with low impact on availability of the application.","summary":"SAP says the SAP Kernel used by Application Server ABAP of NetWeaver and ABAP Platform does not properly validate RFC protocol messages. An unauthenticated attacker can send a crafted RFC request that triggers memory corruption, with high impact on confidentiality and integrity and low impact on availability. The fix is in SAP Security Note 3769130.","severity":"high","cvss":8.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP Kernel (NetWeaver AS ABAP / ABAP Platform)","fixed":[],"affected":"KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.53, 8.04; KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["abap-platform","netweaver","rfc","runtime","sap","sap-kernel","unauthenticated"],"not_affected_if":[],"how_to_check":"- Check your SAP kernel release (SM51 or transaction SMICM, or 'disp+work -version' on the host) against the affected kernel list: KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.53, 8.04; KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20. Source: CVE record via mirror, not SAP's own page.\n- Open SAP Security Note 3769130 in SAP for Me for the fixed patch levels per kernel.\n- Check whether the RFC gateway/dispatcher ports (3300-3399, 33xx) are reachable from untrusted networks.","fix":"Apply SAP Security Note 3769130 (needs SAP for Me login). Fixed kernel patch levels: unknown, not readable without login.","status":"open","published_at":"2026-11-10T01:17:20+00:00","first_seen_at":"2026-11-10T01:26:42+00:00","triaged_at":"2026-11-10T01:28:17+00:00","updated_at":"2026-11-10T01:32:56+00:00","category":"runtime","confidence":0.55,"triage":{"at":"2026-11-10T01:28:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver ABAP: crafted RFC request corrupts memory, unauthenticated attacker","impact":"high","summary":"The SAP Kernel used by the SAP NetWeaver and ABAP Platform Application Server ABAP does not properly validate RFC protocol messages. An unauthenticated attacker who sends a crafted RFC request can trigger memory corruption, which may expose or alter application data.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sap","netweaver","abap-platform","sap-kernel","rfc"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Memory corruption exposes or alters application data without login","analyst_note":"Find the SAP security note for CVE-2026-76966 and the affected kernel and NetWeaver release ranges; the NVD entry alone gives no versions or fix.","how_to_check":"- Check the installed SAP kernel and NetWeaver/ABAP Platform release against the SAP security note for CVE-2026-76966 (unknown: sources do not give the affected kernel patch levels)\n- Confirm whether RFC ports (typically 33xx/48xx) are reachable from untrusted networks (unknown: sources do not say how to check)","plain_action":"","product_name":"SAP Kernel","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4584,"output_tokens":557,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the SAP security note for CVE-2026-76966 and the affected kernel and NetWeaver release ranges; the NVD entry alone gives no versions or fix.","search":"'-2026':12A,15A '-76966':13A,16A '3769130':89B 'abap':3A,21A,22A,25B,44B,48B,105C,110C 'abap-platform':24B 'applic':42B,103C,150C 'as':20A 'attack':10A,59B,114C 'avail':81B,147C 'confidenti':74B,140C 'corrupt':7A,69B,131C 'could':133C 'craft':4A,63B,118C 'cve':11A,14A 'due':90C 'error':124C 'exploit':122C 'fix':83B 'high':71B,137C 'impact':72B,79B,138C,145C 'improp':92C 'integr':76B,142C 'kernel':18A,33B,39B,99C 'lead':128C,134C 'logic':123C 'low':78B,144C 'manag':127C 'memori':8A,68B,126C,130C 'messag':56B 'netweav':2A,27B,46B,108C 'netweaver':19A 'note':88B 'platform':23A,26B,49B,111C 'proper':52B 'protocol':55B,94C 'request':6A,65B,120C 'rfc':5A,28B,54B,64B,93C,119C 'runtim':29B 'sap':1A,17A,30B,32B,35B,38B,86B,98C,107C 'sap-kernel':31B 'say':36B 'secur':87B 'send':61B,116C 'server':43B,104C 'trigger':67B 'unauthent':9A,34B,58B,113C 'use':40B,100C 'valid':53B,95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["kernelnetweaverasabapabapplatform","sapkernelnetweaverasabapabapplatform"],"ptokens":["abap","as","kernel","netweaver","platform","sap"],"labels":["abapplatform","high","netweaver","rfc","runtime","sap","sapkernel","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-2026':12A,15A '-76966':13A,16A 'abap':3A,21A,22A 'as':20A 'attack':10A 'corrupt':7A 'craft':4A 'cve':11A,14A 'kernel':18A 'memori':8A 'netweav':2A 'netweaver':19A 'platform':23A 'request':6A 'rfc':5A 'sap':1A,17A 'unauthent':9A","search_b":"'3769130':89B 'abap':25B,44B,48B 'abap-platform':24B 'applic':42B 'attack':59B 'avail':81B 'confidenti':74B 'corrupt':69B 'craft':63B 'fix':83B 'high':71B 'impact':72B,79B 'integr':76B 'kernel':33B,39B 'low':78B 'memori':68B 'messag':56B 'netweav':27B,46B 'note':88B 'platform':26B,49B 'proper':52B 'protocol':55B 'request':65B 'rfc':28B,54B,64B 'runtim':29B 'sap':30B,32B,35B,38B,86B 'sap-kernel':31B 'say':36B 'secur':87B 'send':61B 'server':43B 'trigger':67B 'unauthent':34B,58B 'use':40B 'valid':53B","search_c":"'abap':105C,110C 'applic':103C,150C 'attack':114C 'avail':147C 'confidenti':140C 'corrupt':131C 'could':133C 'craft':118C 'due':90C 'error':124C 'exploit':122C 'high':137C 'impact':138C,145C 'improp':92C 'integr':142C 'kernel':99C 'lead':128C,134C 'logic':123C 'low':144C 'manag':127C 'memori':126C,130C 'netweav':108C 'platform':111C 'protocol':94C 'request':120C 'rfc':93C,119C 'sap':98C,107C 'send':116C 'server':104C 'unauthent':113C 'use':100C 'valid':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76966","severity":null,"published_at":"2026-11-10T01:17:20+00:00","modified_at":"2026-11-10T01:17:20+00:00","first_seen_at":"2026-11-10T01:26:42+00:00","fetched_at":"2026-11-10T01:26:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76966:2382","url":"https://hol.org/guard/security/cves/CVE-2026-76966-multiple-vulnerabilities-in-application-server","severity":null,"published_at":"2026-11-10T01:32:56+00:00","modified_at":"2026-11-10T01:32:56+00:00","first_seen_at":"2026-11-10T01:32:56+00:00","fetched_at":"2026-11-10T01:32:56+00:00","note":"SAP fix is Security Note 3769130 (me.sap.com, login-walled; not read). Kernel list comes from the CVE List V5 record via the HOL Guard mirror, not SAP's own page. The patch day page for Sept 2026 does not list this CVE and the Nov 2026 page 404s, so the patch day and fixed kernel patch levels are unknown. Nothing verified. No exploitation or PoC found. X not searched. Note: HOL lists CWE-294 and 'Missing Auth', which does not fit the description; I ignored it. Different CVE from CVE-2026-27671 (note 3717897, June).","cites":["https://hol.org/guard/security/cves/CVE-2026-76966-multiple-vulnerabilities-in-application-server"]}],"documents":[{"id":112451,"url":"https://hol.org/guard/security/cves/CVE-2026-76966-multiple-vulnerabilities-in-application-server","title":"HOL Guard record for CVE-2026-76966 (mirrors CVE List V5, cites SAP note 3769130)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}