CVE-2026-76973: Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (SAP Message Server)
Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker who can send network requests to the affected SAP Message Server service can attempt exploitation. No user interaction or existing privileges are required.
What is the expected impact of successful exploitation?
Successful exploitation can crash the server and disrupt active connections, causing a denial-of-service condition. The provided information indicates availability impact only, with no confidentiality or integrity impact.
Are systems affected under default access conditions?
The vulnerability is network-reachable and does not require authentication, but the available information does not state whether the affected service is exposed or enabled in default deployments.