---
id: "CVE-2026-76970"
page: "https://infrastack.ai/live/CVE-2026-76970"
kind: "vulnerability"
aliases: ["CVE-2026-76970"]
title: "SAP NetWeaver ABAP: memory corruption lets unauthenticated requests crash the application"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["abap", "kernel", "netweaver", "runtime", "sap", "self-hosted"]
not_affected_if: ["no-sap-abap"]
published_at: "2026-11-10T01:17:20+00:00"
first_seen_at: "2026-11-10T01:26:43+00:00"
updated_at: "2026-11-10T01:32:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76970", "first_seen_at": "2026-11-10T01:26:43+00:00"}, {"source": "analyst", "url": "https://hol.org/guard/security/cves/CVE-2026-76970-memory-corruption-vulnerability-in-application", "first_seen_at": "2026-11-10T01:32:41+00:00", "cites": ["https://hol.org/guard/security/cves/CVE-2026-76970-memory-corruption-vulnerability-in-application"]}]
exploit_sources: []
---

# SAP NetWeaver ABAP: memory corruption lets unauthenticated requests crash the application

Link for people: https://infrastack.ai/live/CVE-2026-76970 (this .md is for agents)

A memory corruption bug in the parsing routine of SAP Application Server ABAP, part of SAP NetWeaver and ABAP Platform, can be triggered by specially crafted requests. Repeated requests crash and restart the affected processes, giving an unauthenticated attacker a sustained denial of service; confidentiality and integrity are unaffected.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check your kernel release and patch level (transaction SM51 or 'disp+work -version'). Per the CVE record, affected kernels are KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.22EX2, 7.22EX3, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.20, 9.21; KERNEL 7.22. Confirm against SAP Note 3792915 (me.sap.com/notes/3792915, SAP login needed) for patch levels.

## Fix

Apply SAP Security Note 3792915 (kernel patch; fixed kernel patch levels not readable without SAP login, unknown)

## Timeline

- 2026-11-10T01:26:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76970
- 2026-11-10T01:32:41+00:00 analyst https://hol.org/guard/security/cves/CVE-2026-76970-memory-corruption-vulnerability-in-application — SAP note 3792915 (me.sap.com, login-gated, not read). Affected kernel list taken from CVE List V5 via HOL Guard mirror; no SAP primary page read, nothing verified. Nov 2026 patch day page returned 404; web search worked, X not tried. Fix versions unknown. No exploitation or PoC reported.

## Documents

- [describes] HOL Guard record for CVE-2026-76970 (mirrors CVE List V5 / SAP CNA data) https://hol.org/guard/security/cves/CVE-2026-76970-memory-corruption-vulnerability-in-application

## From the sources

Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could cause the affected processes to crash and restart. By repeatedly sending such requests, the attacker could cause a sustained denial of service, leading to a high impact on availability. Confidentiality and integrity remain unaffected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_