CVE-2026-76965: OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP Platform
SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on the underlying host. Successful exploitation could impact resources beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability of the system.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs low-privilege access to the affected SAP NetWeaver Application Server ABAP or SAP ABAP Platform system. No user interaction is required.
What could successful exploitation allow?
Successful exploitation could allow execution of arbitrary operating system commands on the underlying host. The impact can extend beyond the vulnerable component and affect confidentiality, integrity, and availability.
Is this remotely exploitable?
The attack vector is network-based, so exploitation can be attempted over the network by an attacker who has the required low-privilege access.