CVE-2026-76964: Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An unauthenticated attacker who can send network traffic to the affected Internet Communication Manager functionality could exploit it. No user interaction or existing privileges are required.
What is the potential impact of successful exploitation?
Successful exploitation could permit arbitrary code execution and full system compromise. Confidentiality, integrity, and availability can all be affected.
What attacker action triggers the issue?
The attacker sends specially crafted network traffic that reaches the internal component handling the insufficiently validated input. The data does not identify a required application-level account or authentication step.