CVE-2026-76968: Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed information could potentially be used to facilitate further attacks. This vulnerability has a high impact on the confidentiality of the application, with no impact on integrity or availability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have low-privileged access to an affected SAP Web Dispatcher, SAP Internet Communication Manager, or SAP Content Server instance. Exploitation is network-accessible and does not require user interaction.
What is the impact if exploitation succeeds?
The attacker can obtain sensitive information about the system state through certain administrative functionality or interfaces. The stated direct impact is high confidentiality impact, with no integrity or availability impact.
Could the disclosed information enable additional attacks?
Yes. The disclosed system-state information could potentially be used to facilitate further attacks.