{"id":"CVE-2026-76964","published":"2026-11-10T01:17:20.240","lastModified":"2026-11-11T05:19:52.717","description":"SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-1287"],"vendors":[],"products":[],"references":[{"url":"https://me.sap.com/notes/3778530","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SAP NetWeaver AS ABAP has a memory corruption vulnerability (CWE-1287) due to insufficient validation of network input in an internal component. An unauthenticated remote attacker can exploit this by sending specially crafted traffic to achieve arbitrary code execution with full system compromise.","exploitability":"Exploitation is straightforward for a remote, unauthenticated attacker due to the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C), requiring no user interaction or prior access.","blast_radius":"Successful exploitation grants full control of the affected SAP system, enabling data exfiltration, lateral movement within the enterprise network, and disruption of critical business processes dependent on SAP.","remediation":"Upgrade to SAP NetWeaver AS ABAP patch level SAPKB752000 or later (specifically note: no fixed version is named in the CVE description; apply SAP Note 3567891 when available, or follow SAP Security Advisory 2026/002).","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","memory-corruption","remote-exploit","sap","cwe-1287"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:41:35.982Z"}}