{"id":"CVE-2026-76973","kind":"vulnerability","aliases":["CVE-2026-76973"],"related":[],"title":"SAP NetWeaver ABAP Message Server: integer overflow lets unauthenticated network requests crash the server","description":"Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected.","summary":"A memory corruption flaw in the Application Server ABAP of SAP NetWeaver and ABAP Platform can be triggered by specially crafted network requests. A successful attack crashes the server and disrupts active connections, causing denial of service without exposing or changing data.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP NetWeaver and ABAP Platform (Message Server)","fixed":[],"affected":"KRNL64NUC 7.22; KRNL64UC 7.22, 7.22EXT, 7.53, 8.04; KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20, 9.21","ecosystem":"vendor"}],"ecosystems":[],"tags":["abap","denial-of-service","kernel","message-server","netweaver","sap","self-hosted","vendor"],"not_affected_if":["message-server-not-reachable","no-sap-netweaver"],"how_to_check":"In SAP, run transaction SM51 or SMMS (or /sap/public/info) and check the kernel release and patch level (System > Status > Kernel information). Affected kernels per SAP's CVE record: KRNL64NUC 7.22; KRNL64UC 7.22, 7.22EXT, 7.53, 8.04; KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20, 9.21. Compare the patch level with the fixed level in SAP Note 3789273 (needs SAP for Me login). Also check whether the Message Server port (36xx / 39xx) is reachable from untrusted networks.","fix":"Apply SAP Security Note 3789273 (kernel patch). The exact fixed kernel patch levels are in the note, which requires SAP login and was not read; unknown here.","status":"open","published_at":"2026-11-10T01:17:20+00:00","first_seen_at":"2026-11-10T01:26:43+00:00","triaged_at":"2026-11-10T01:28:26+00:00","updated_at":"2026-11-10T01:32:47+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-10T01:28:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver ABAP: memory corruption lets unauthenticated requests crash the server","impact":"low","summary":"A memory corruption flaw in the Application Server ABAP of SAP NetWeaver and ABAP Platform can be triggered by specially crafted network requests. A successful attack crashes the server and disrupts active connections, causing denial of service without exposing or changing data.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","abap"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Server crashes and active connections are disrupted, causing denial of service","analyst_note":"Find SAP's security note for CVE-2026-76973 to get affected releases, patch levels and the fixed versions; NVD alone gives no product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-sap-netweaver"],"who_is_affected":"Systems running SAP NetWeaver or ABAP Platform with the Application Server ABAP component reachable over the network are exposed. The sources do not name the affected releases or patch levels, so check SAP's security note for this CVE. Organizations not running SAP NetWeaver or ABAP Platform are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4610,"output_tokens":503,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find SAP's security note for CVE-2026-76973 to get affected releases, patch levels and the fixed versions; NVD alone gives no product ranges.","search":"'-2026':16A,19A '-76973':17A,20A 'abap':3A,24A,28B,51B,56B,94C,99C 'activ':74B,128C 'affect':112C 'and':23A 'applic':49B,92C 'attack':68B,103C,119C 'avail':147C 'caus':76B,121C 'chang':83B 'condit':136C 'confidenti':150C 'connect':75B,129C 'corrupt':45B,89C 'could':104C,120C,139C 'craft':63B,107C 'crash':12A,69B,125C 'cve':15A,18A 'data':84B 'denial':30B,77B,133C 'denial-of-servic':29B 'disrupt':73B,127C 'due':85C 'exploit':138C 'expos':81B 'flaw':46B 'high':143C 'host':41B 'impact':144C 'integ':6A 'integr':152C 'kernel':33B 'lead':130C 'let':8A 'memori':44B,88C 'messag':4A,35B 'message':26A 'message-serv':34B 'netweav':2A,37B,54B,97C 'netweaver':22A 'network':10A,64B,108C 'overflow':7A 'platform':25A,57B,100C 'remain':153C 'request':11A,65B,109C 'result':140C 'sap':1A,21A,38B,53B,96C 'self':40B 'self-host':39B 'send':105C 'server':5A,14A,27A,36B,50B,71B,93C,123C 'servic':32B,79B,113C,135C 'special':62B,106C 'success':67B,137C 'trigger':60B,115C 'unaffect':154C 'unauthent':9A,102C 'vendor':42B 'vulner':90C,117C 'without':80B","nicknames":[],"mitigations":[],"who_affected":"SAP NetWeaver / ABAP Platform systems whose Application Server ABAP kernel is in the listed releases (7.22 to 9.21), specifically the Message Server service, are exposed to an unauthenticated network attacker who can crash it and drop active connections. Data confidentiality and integrity are not affected. Teams not running SAP ABAP kernels, or whose Message Server port is only reachable from trusted internal hosts, are at much lower risk.","tier":"B","verified":{"products":{"at":"2026-11-10T01:32:47Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-76973","run_id":2380},"who_affected":{"at":"2026-11-10T01:32:47Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-76973","run_id":2380}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["netweaverandabapplatformmessageserver","sapnetweaverandabapplatformmessageserver"],"ptokens":["abap","and","message","netweaver","platform","sap","server"],"labels":["abap","denialofservice","high","kernel","messageserver","netweaver","sap","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':16A,19A '-76973':17A,20A 'abap':3A,24A 'and':23A 'crash':12A 'cve':15A,18A 'integ':6A 'let':8A 'messag':4A 'message':26A 'netweav':2A 'netweaver':22A 'network':10A 'overflow':7A 'platform':25A 'request':11A 'sap':1A,21A 'server':5A,14A,27A 'unauthent':9A","search_b":"'abap':28B,51B,56B 'activ':74B 'applic':49B 'attack':68B 'caus':76B 'chang':83B 'connect':75B 'corrupt':45B 'craft':63B 'crash':69B 'data':84B 'denial':30B,77B 'denial-of-servic':29B 'disrupt':73B 'expos':81B 'flaw':46B 'host':41B 'kernel':33B 'memori':44B 'messag':35B 'message-serv':34B 'netweav':37B,54B 'network':64B 'platform':57B 'request':65B 'sap':38B,53B 'self':40B 'self-host':39B 'server':36B,50B,71B 'servic':32B,79B 'special':62B 'success':67B 'trigger':60B 'vendor':42B 'without':80B","search_c":"'abap':94C,99C 'activ':128C 'affect':112C 'applic':92C 'attack':103C,119C 'avail':147C 'caus':121C 'condit':136C 'confidenti':150C 'connect':129C 'corrupt':89C 'could':104C,120C,139C 'craft':107C 'crash':125C 'denial':133C 'disrupt':127C 'due':85C 'exploit':138C 'high':143C 'impact':144C 'integr':152C 'lead':130C 'memori':88C 'netweav':97C 'network':108C 'platform':100C 'remain':153C 'request':109C 'result':140C 'sap':96C 'send':105C 'server':93C,123C 'servic':113C,135C 'special':106C 'success':137C 'trigger':115C 'unaffect':154C 'unauthent':102C 'vulner':90C,117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76973","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76973","severity":null,"published_at":"2026-11-10T01:17:20+00:00","modified_at":"2026-11-10T01:17:20+00:00","first_seen_at":"2026-11-10T01:26:43+00:00","fetched_at":"2026-11-10T01:26:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76973:2380","url":"https://cveawg.mitre.org/api/cve/CVE-2026-76973","severity":null,"published_at":"2026-11-10T01:32:47+00:00","modified_at":"2026-11-10T01:32:47+00:00","first_seen_at":"2026-11-10T01:32:47+00:00","fetched_at":"2026-11-10T01:32:47+00:00","note":"SAP's CNA record (cve.org data) names SAP Message Server component, CWE-190, kernel versions, SAP Note 3789273 (behind SAP login, not read). Fixed patch levels unknown; no exploitation or PoC found.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-76973"]}],"documents":[{"id":112449,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-76973","title":"CVE-2026-76973 CVE record published by SAP (CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}