---
id: "CVE-2026-76966"
page: "https://infrastack.ai/live/CVE-2026-76966"
kind: "vulnerability"
aliases: ["CVE-2026-76966"]
title: "SAP NetWeaver ABAP: crafted RFC request corrupts memory, unauthenticated attacker"
severity: "high"
cvss: 8.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "SAP Kernel (NetWeaver AS ABAP / ABAP Platform)", "fixed": [], "affected": "KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.53, 8.04; KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["abap-platform", "netweaver", "rfc", "runtime", "sap", "sap-kernel", "unauthenticated"]
not_affected_if: []
published_at: "2026-11-10T01:17:20+00:00"
first_seen_at: "2026-11-10T01:26:42+00:00"
updated_at: "2026-11-10T01:32:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76966", "first_seen_at": "2026-11-10T01:26:42+00:00"}, {"source": "analyst", "url": "https://hol.org/guard/security/cves/CVE-2026-76966-multiple-vulnerabilities-in-application-server", "first_seen_at": "2026-11-10T01:32:56+00:00", "cites": ["https://hol.org/guard/security/cves/CVE-2026-76966-multiple-vulnerabilities-in-application-server"]}]
exploit_sources: []
---

# SAP NetWeaver ABAP: crafted RFC request corrupts memory, unauthenticated attacker

Link for people: https://infrastack.ai/live/CVE-2026-76966 (this .md is for agents)

SAP says the SAP Kernel used by Application Server ABAP of NetWeaver and ABAP Platform does not properly validate RFC protocol messages. An unauthenticated attacker can send a crafted RFC request that triggers memory corruption, with high impact on confidentiality and integrity and low impact on availability. The fix is in SAP Security Note 3769130.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP Kernel (NetWeaver AS ABAP / ABAP Platform) affected KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.53, 8.04; KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 fixed no fixed version listed

## How to check

- Check your SAP kernel release (SM51 or transaction SMICM, or 'disp+work -version' on the host) against the affected kernel list: KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.53, 8.04; KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20. Source: CVE record via mirror, not SAP's own page.
- Open SAP Security Note 3769130 in SAP for Me for the fixed patch levels per kernel.
- Check whether the RFC gateway/dispatcher ports (3300-3399, 33xx) are reachable from untrusted networks.

## Fix

Apply SAP Security Note 3769130 (needs SAP for Me login). Fixed kernel patch levels: unknown, not readable without login.

## Timeline

- 2026-11-10T01:26:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76966
- 2026-11-10T01:32:56+00:00 analyst https://hol.org/guard/security/cves/CVE-2026-76966-multiple-vulnerabilities-in-application-server — SAP fix is Security Note 3769130 (me.sap.com, login-walled; not read). Kernel list comes from the CVE List V5 record via the HOL Guard mirror, not SAP's own page. The patch day page for Sept 2026 does not list this CVE and the Nov 2026 page 404s, so the patch day and fixed kernel patch levels are unknown. Nothing verified. No exploitation or PoC found. X not searched. Note: HOL lists CWE-294 and 'Missing Auth', which does not fit the description; I ignored it. Different CVE from CVE-2026-27671 (note 3717897, June).

## Documents

- [describes] HOL Guard record for CVE-2026-76966 (mirrors CVE List V5, cites SAP note 3769130) https://hol.org/guard/security/cves/CVE-2026-76966-multiple-vulnerabilities-in-application-server

## From the sources

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on confidentiality and integrity with low impact on availability of the application.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_