CVE-2026-76970: Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform
Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could cause the affected processes to crash and restart. By repeatedly sending such requests, the attacker could cause a sustained denial of service, leading to a high impact on availability. Confidentiality and integrity remain unaffected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by sending specially crafted requests to the affected application. No privileges or user interaction are required.
What is the expected impact of successful exploitation?
Successful exploitation can crash and restart affected processes. Repeated requests can sustain a denial of service with high availability impact; confidentiality and integrity are not affected.
What conditions are required for exploitation?
The crafted requests must be processed by the application and trigger the vulnerable parsing routine. The provided information does not identify a specific configuration prerequisite.