Vulnerability details
CVE-2026-76965
SAP_SE SAP NetWeaver and ABAP Platform
OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP Platform
CVSS 3.1
9.9Critical
Official description
SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on the underlying host. Successful exploitation could impact resources beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability of the system.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.9Critical | 3.1 | CVEProject cvelistV5 (CNA) (sap) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| SAP_SE | SAP NetWeaver and ABAP Platform | 7.22EXT | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver and ABAP Platform | 7.53 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver and ABAP Platform | 7.54 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver and ABAP Platform | 7.77 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver and ABAP Platform | 7.93 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver and ABAP Platform | 9.16 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver and ABAP Platform | KERNEL 7.22 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver and ABAP Platform | KRNL64NUC 7.22 | CVEProject cvelistV5 (CNA) |
| SAP_SE | SAP NetWeaver and ABAP Platform | KRNL64UC 7.22 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-11-10
- Last updated
- 2026-11-10
- State
- Published
- Assigner (CNA)
- sap
- Kolun priority
- 21 · Low
Exploit prediction (EPSS)
0.31%
Probability of exploitation in 30 days
24.3%
Percentile (among all CVEs)
Weaknesses (CWE)
- CWE-749Exposed Dangerous Method or Function