SAP NETWEAVER AND ABAP PLATFORM (MESSAGE SERVER) · CVE-2026-76973 · Vendor
NO FIX YET · SEE WHAT TO DO
A memory corruption flaw in the Application Server ABAP of SAP NetWeaver and ABAP Platform can be triggered by specially crafted network requests. A successful attack crashes the server and disrupts active connections, causing denial of service without exposing or changing data.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
SAP NetWeaver / ABAP Platform systems whose Application Server ABAP kernel is in the listed releases (7.22 to 9.21), specifically the Message Server service, are exposed to an unauthenticated network attacker who can crash it and drop active connections. Data confidentiality and integrity are not affected. Teams not running SAP ABAP kernels, or whose Message Server port is only reachable from trusted internal hosts, are at much lower risk.
Not affected if message-server-not-reachable, no-sap-netweaver
Who cares abap, denial-of-service, kernel, message-server, netweaver, sap, self-hosted
Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.