MajorCritical vulnerability

CVE-2026-76966 (CVSS 8.9)

NVD · officialPublished Nov 10, 2026Risk 37/100

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on confidentiality and integrity with low impact on availability of the application.

Technical details

CVSS

8.9

AV:NetworkAC:HighPR:NoneUI:NoneC:HighI:HighA:Low

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source