CVE-2026-76966: Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on confidentiality and integrity with low impact on availability of the application.
Affected Software
Event History
Frequently Asked Questions
Who can attempt to exploit this issue?
An unauthenticated attacker can attempt exploitation remotely by sending a crafted RFC request to an affected Application Server ABAP. No prior account or user interaction is required.
What capabilities does an attacker need for successful exploitation?
The attack requires network access to the RFC service and a crafted RFC request. The reported attack complexity is high, indicating exploitation depends on meeting nontrivial conditions beyond simply reaching the service.
What is the likely impact if exploitation succeeds?
Successful exploitation can cause memory corruption through logical errors in memory management. It has high potential impact on confidentiality and integrity and low impact on availability.