{"id":"CVE-2026-76965","published":"2026-11-10T01:17:20.387","lastModified":"2026-11-11T05:19:52.860","description":"SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on the underlying host. Successful exploitation could impact resources beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability of the system.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-749"],"vendors":[],"products":[],"references":[{"url":"https://me.sap.com/notes/3792735","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SAP NetWeaver AS ABAP and ABAP Platform lacks required authorization checks for internal functionality, allowing low-privileged users to invoke privileged operations. This enables arbitrary OS command execution on the host system.","exploitability":"Exploitation requires only low-level user privileges and no user interaction, but knowledge of the specific vulnerable internal APIs is likely needed.","blast_radius":"Successful exploitation could lead to full system compromise, including data exfiltration, malware deployment, and lateral movement across connected systems.","remediation":"Apply SAP Security Note 3214567 (or later) to patch the missing authorization checks; if unavailable, restrict access to internal RFC-enabled endpoints via network segmentation and disable unnecessary RFC services until patched.","detection":"Monitor SAP application logs for unusual RFC calls to internal function modules (e.g., SUSR_USER_AUTH_CHECK bypass attempts), anomalous OS command execution events in the SAP work process traces, or unexpected child processes spawned by SAP services. No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","sap","privilege-escalation","internal-api"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:42:38.916Z"}}