Introduction
A single crafted request, sent without any credentials, can corrupt memory inside a worker process of SAP NetWeaver Internet Graphics Service (IGS) and cause that process to terminate repeatedly. SAP rates the issue 8.2 (High). IGS sits alongside NetWeaver systems that run core business processes, so a reliably crashable rendering service is an availability problem that SAP administrators will want to scope quickly.
IGS is a component of SAP NetWeaver that generates graphical or nongraphical output from SAP or other data sources. SAP systems submit work to it over RFC or HTTP(S), and other systems submit HTTP(S) requests. Many SAP landscapes depend on this internal service for rendering. SAP was founded in 1972 and describes itself as a global leader in enterprise applications, serving finance, procurement, human resources, supply chain and customer experience functions.
Technical information
Root cause
According to the SAP CNA record, IGS does not sufficiently validate certain input values within incoming requests. An unauthenticated user can send a specially crafted request that triggers an out-of-bounds memory write in a worker process. The disclosed results are memory corruption or repeated termination of the affected process.
The assigned weakness is CWE-787, Out of bounds Write, which MITRE defines as writing data past the end, or before the beginning, of the intended buffer. That classification explains the class of memory safety failure. The public records do not identify the vulnerable function, the buffer involved, whether the overwrite targets stack or heap memory, or the exact input that corrupts it. No vulnerable code has been published.
Where IGS processes requests
SAP's IGS architecture documentation shows where untrusted input travels:
- Listeners receive RFC or HTTP(S) requests.
- A multiplexer distributes the request data to a portwatcher.
- The portwatcher assigns the work to an interpreter, which performs semantic processing and returns the result.
The CVE disclosure does not say which listener carries the vulnerable request or which interpreter is involved. We treat this architecture as background only. It is not a demonstrated exploitation path.
Attack flow as disclosed
Based solely on the CNA and NVD descriptions, the sequence is:
- An attacker with network access to IGS sends a specially crafted request. No authentication and no user interaction are required.
- IGS fails to adequately validate certain input values in that request.
- Processing of the unvalidated values causes an out-of-bounds write inside a worker process.
- The worker suffers memory corruption or terminates. Repeating the request can cause repeated termination, which is the basis for the High availability rating.
The public records include no request path, parameter name, payload format or reproducible exploit.
CVSS assessment
SAP, as the CNA, contributed the following CVSS 3.1 vector, scored at 8.2 High:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality: None
- Integrity: Low
- Availability: High
The scoring describes prerequisites and severity. It is not evidence of exploitation, and the disclosure does not establish arbitrary code execution, sandbox escape or host takeover. The confirmed concern is service disruption with limited integrity impact.
Exploitation status
The reviewed SAP CNA and NVD records do not identify active exploitation, a public exploit, named threat actors or indicators of compromise. The CNA record lists discovery as UNKNOWN, which should not be read as an exploitation status. The CISA KEV JSON snapshot available to us (catalog version 2026.11.09) was released before this CVE was published, so it cannot tell us whether the CVE has since been added. We consider exploitation and attribution unresolved rather than absent.
Affected systems and versions
SAP lists the following releases of the BC-FES-IGS component of SAP NetWeaver Internet Graphics Service as affected:
- 7.20EXT
- 7.20_EX2
- 7.53
- 7.54
- 7.81
- 9.16
These are affected release identifiers. The public records do not list corrected patch levels or operating-system-specific applicability.
The vulnerability-specific reference is SAP Security Note 3809953, which requires an SAP for Me login. Its correction instructions, prerequisites and any workaround are not publicly readable. Separately, SAP's general IGS security guidance recommends running the latest IGS patch, protecting IGS with a firewall, and deactivating the HTTP listener if Web Dynpro Java is not used. The CVE does not identify which protocol carries the vulnerable request, so listener deactivation should not be assumed to be a complete workaround. SAP also notes that HTTP administration and monitoring are disabled by default, and that if HTTP administration is enabled, incoming HTTP requests should be traced with the sender IP. For ABAP-based frontend technology, SAP recommends authorization for transaction SIGS and report GRAPHICS_IGS_ADMIN. That authorization governs administration and does not block an unauthenticated request.
Vendor security history
SAP runs a monthly Security Patch Day on the second Tuesday and recommends implementing Security Notes with priority. Security fixes for NetWeaver-based products are delivered through support packages. SAP also describes threat modeling, secure programming guidelines, code reviews and bug bounty programs as part of its development process.
Two documented NetWeaver cases provide context, though neither involves IGS:
- 2016 Invoker Servlet exploitation: CISA reported exploitation involving the Invoker Servlet in SAP NetWeaver Application Server Java, with at least 36 organizations affected. SAP had patched the issue in 2010, but outdated and misconfigured systems remained exposed. Potential consequences included unauthenticated full access to affected SAP platforms. Publishing a fix did not by itself remove the exposure.
- CVE-2025-31324: An unrestricted file upload vulnerability in SAP NetWeaver that CISA added to the Known Exploited Vulnerabilities catalog on April 29, 2025, based on evidence of active exploitation.
These cases differ from CVE-2026-120008 in component, mechanism and demonstrated impact, and they are not evidence that this IGS flaw is being exploited.
References
- NVD: CVE-2026-120008
- CVE Record: CVE-2026-120008 (CVE Services API)
- NVD API record for CVE-2026-120008
- SAP Security Note 3809953 (SAP for Me login required)
- SAP Security Patch Day
- SAP Security Notes and News
- SAP Help: IGS Architecture
- SAP Help: Internet Graphics Service Security
- MITRE CWE-787: Out of bounds Write
- FIRST CVSS v3.1 Specification
- CISA: Exploitation of SAP Business Applications (2016)
- CISA: Adds One Known Exploited Vulnerability to Catalog (April 29, 2025)
- CISA Known Exploited Vulnerabilities Catalog
- CISA KEV JSON feed
- SAP History
- SAP Company Information
- SAP Trust Center: Security
