{"id":"CVE-2026-76970","kind":"vulnerability","aliases":["CVE-2026-76970"],"related":[],"title":"SAP NetWeaver ABAP: memory corruption lets unauthenticated requests crash the application","description":"Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could cause the affected processes to crash and restart. By repeatedly sending such requests, the attacker could cause a sustained denial of service, leading to a high impact on availability. Confidentiality and integrity remain unaffected.","summary":"A memory corruption bug in the parsing routine of SAP Application Server ABAP, part of SAP NetWeaver and ABAP Platform, can be triggered by specially crafted requests. Repeated requests crash and restart the affected processes, giving an unauthenticated attacker a sustained denial of service; confidentiality and integrity are unaffected.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["abap","kernel","netweaver","runtime","sap","self-hosted"],"not_affected_if":["no-sap-abap"],"how_to_check":"Check your kernel release and patch level (transaction SM51 or 'disp+work -version'). Per the CVE record, affected kernels are KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.22EX2, 7.22EX3, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20, 9.21; KERNEL 7.22. Confirm against SAP Note 3792915 (me.sap.com/notes/3792915, SAP login needed) for patch levels.","fix":"Apply SAP Security Note 3792915 (kernel patch; fixed kernel patch levels not readable without SAP login, unknown)","status":"open","published_at":"2026-11-10T01:17:20+00:00","first_seen_at":"2026-11-10T01:26:43+00:00","triaged_at":"2026-11-10T01:28:34+00:00","updated_at":"2026-11-10T01:32:41+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T01:28:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"SAP NetWeaver ABAP: memory corruption lets unauthenticated requests crash the application","impact":"low","summary":"A memory corruption bug in the parsing routine of SAP Application Server ABAP, part of SAP NetWeaver and ABAP Platform, can be triggered by specially crafted requests. Repeated requests crash and restart the affected processes, giving an unauthenticated attacker a sustained denial of service; confidentiality and integrity are unaffected.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sap","netweaver","abap"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Repeated crafted requests cause sustained denial of service on ABAP processes","analyst_note":"Find SAP's security note for CVE-2026-76970 to get affected releases, patch and reachable endpoints; the NVD entry alone does not give them.","how_to_check":"unknown","plain_action":"","product_name":"SAP NetWeaver Application Server ABAP","needs_analyst":true,"not_affected_if":["no-sap-abap"],"who_is_affected":"Organizations running SAP Application Server ABAP through SAP NetWeaver or ABAP Platform are the exposed systems, since the flaw is reachable without authentication by sending crafted requests to the application. The sources do not list affected releases or which request paths reach the parsing routine. Teams not running SAP ABAP systems can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4630,"output_tokens":578,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find SAP's security note for CVE-2026-76970 to get affected releases, patch and reachable endpoints; the NVD entry alone does not give them.","search":"'-2026':13A,16A '-76970':14A,17A 'abap':3A,18B,38B,44B,84C,89C 'affect':59B,123C 'applic':11A,36B,82C,101C,106C 'attack':64B,93C,135C 'avail':149C 'bug':29B 'caus':121C,137C 'condit':114C 'confidenti':70B,150C 'corrupt':5A,28B,79C,113C 'could':94C,109C,120C,136C 'craft':51B,97C 'crash':9A,55B,126C 'cve':12A,15A 'denial':67B,140C 'due':75C 'give':61B 'high':146C 'host':25B 'impact':147C 'integr':72B,152C 'kernel':19B 'lead':143C 'let':6A 'memori':4A,27B,78C,112C 'netweav':2A,20B,42B,87C 'pars':32B,117C 'part':39B 'platform':45B,90C 'process':60B,103C,124C 'remain':153C 'repeat':53B,130C 'request':8A,52B,54B,98C,108C,133C 'restart':57B,128C 'routin':33B,118C 'runtim':21B 'sap':1A,22B,35B,41B,86C 'self':24B 'self-host':23B 'send':95C,131C 'server':37B,83C 'servic':69B,142C 'special':50B,96C 'sustain':66B,139C 'trigger':48B,110C 'unaffect':74B,154C 'unauthent':7A,63B,92C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"SAP systems running Application Server ABAP (NetWeaver / ABAP Platform) on the kernel releases listed in the CVE record, where the ABAP server can receive requests from an untrusted network. No login is needed; crafted requests crash and restart work processes, so repeated requests can keep the system down. Data confidentiality and integrity are not affected. Systems not reachable by attackers are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["abap","high","kernel","netweaver","runtime","sap","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-76970':14A,17A 'abap':3A 'applic':11A 'corrupt':5A 'crash':9A 'cve':12A,15A 'let':6A 'memori':4A 'netweav':2A 'request':8A 'sap':1A 'unauthent':7A","search_b":"'abap':18B,38B,44B 'affect':59B 'applic':36B 'attack':64B 'bug':29B 'confidenti':70B 'corrupt':28B 'craft':51B 'crash':55B 'denial':67B 'give':61B 'host':25B 'integr':72B 'kernel':19B 'memori':27B 'netweav':20B,42B 'pars':32B 'part':39B 'platform':45B 'process':60B 'repeat':53B 'request':52B,54B 'restart':57B 'routin':33B 'runtim':21B 'sap':22B,35B,41B 'self':24B 'self-host':23B 'server':37B 'servic':69B 'special':50B 'sustain':66B 'trigger':48B 'unaffect':74B 'unauthent':63B","search_c":"'abap':84C,89C 'affect':123C 'applic':82C,101C,106C 'attack':93C,135C 'avail':149C 'caus':121C,137C 'condit':114C 'confidenti':150C 'corrupt':79C,113C 'could':94C,109C,120C,136C 'craft':97C 'crash':126C 'denial':140C 'due':75C 'high':146C 'impact':147C 'integr':152C 'lead':143C 'memori':78C,112C 'netweav':87C 'pars':117C 'platform':90C 'process':103C,124C 'remain':153C 'repeat':130C 'request':98C,108C,133C 'restart':128C 'routin':118C 'sap':86C 'send':95C,131C 'server':83C 'servic':142C 'special':96C 'sustain':139C 'trigger':110C 'unaffect':154C 'unauthent':92C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76970","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76970","severity":null,"published_at":"2026-11-10T01:17:20+00:00","modified_at":"2026-11-10T01:17:20+00:00","first_seen_at":"2026-11-10T01:26:43+00:00","fetched_at":"2026-11-10T01:26:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76970:2381","url":"https://hol.org/guard/security/cves/CVE-2026-76970-memory-corruption-vulnerability-in-application","severity":null,"published_at":"2026-11-10T01:32:41+00:00","modified_at":"2026-11-10T01:32:41+00:00","first_seen_at":"2026-11-10T01:32:41+00:00","fetched_at":"2026-11-10T01:32:41+00:00","note":"SAP note 3792915 (me.sap.com, login-gated, not read). Affected kernel list taken from CVE List V5 via HOL Guard mirror; no SAP primary page read, nothing verified. Nov 2026 patch day page returned 404; web search worked, X not tried. Fix versions unknown. No exploitation or PoC reported.","cites":["https://hol.org/guard/security/cves/CVE-2026-76970-memory-corruption-vulnerability-in-application"]}],"documents":[{"id":112448,"url":"https://hol.org/guard/security/cves/CVE-2026-76970-memory-corruption-vulnerability-in-application","title":"HOL Guard record for CVE-2026-76970 (mirrors CVE List V5 / SAP CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}