Introduction
A single crafted HTTP request, sent without credentials, is enough to make the SAP Message Server abort in affected SAP NetWeaver Application Server kernels. The Message Server is the central communication component of an SAP system, so the abort interrupts a service other components rely on until the framework restarts it.
SAP, acting as the CNA, rates CVE-2026-120010 at CVSS 3.1 7.5 (High). NVD published the entry on November 10, 2026 but has not yet provided its own assessment. The NVD vendor field in our source data reads Unknown, but the CVE record attributes the issue to SAP SE. The disclosed impact is availability only: SAP states there is no confidentiality or integrity impact.
Technical information
Root cause
The weakness is classified as CWE-131, Incorrect Calculation of Buffer Size. MITRE defines this as calculating the size of an allocation incorrectly, which can result in a buffer overflow. In this case, the SAP Message Server does not properly size a memory allocation when handling certain HTTP requests. A specially crafted request that reaches the affected functionality overruns the undersized buffer, which is a heap buffer overflow.
The CWE classification describes the class of defect. It does not identify the specific arithmetic, parsing routine or HTTP field involved in SAP's implementation. The public disclosure does not name a vulnerable URL, HTTP method, header, body layout or allocation formula, and no vulnerable code has been published. We therefore cannot show a code excerpt or a concrete request.
Scoring
The published vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Confidentiality / Integrity: None
- Availability: High
These values describe the vulnerability as disclosed. They are not a measured attack rate or a guaranteed outcome for every deployment.
Attack flow
Based on the disclosure, exploitation proceeds as follows:
- The attacker reaches the Message Server HTTP processing path over the network. No account and no user interaction are required.
- The attacker sends a specially crafted HTTP request targeting the affected functionality.
- While handling the request, the Message Server computes an incorrect allocation size and writes past the end of a heap buffer.
- The heap corruption causes the Message Server component to abort.
- The component remains unavailable until the framework restarts it.
The restart is a recovery behavior. Nothing in the disclosure indicates that restarting corrects the underlying sizing defect, and a restarted instance on an affected kernel still carries the same flaw.
Impact boundaries
Although the CWE-131 class can in general lead to code execution or information exposure, SAP explicitly records no confidentiality and no integrity impact for this CVE. On the available evidence, remote code execution, credential theft or data exfiltration should not be attributed to CVE-2026-120010. The correct framing is an unauthenticated, HTTP-triggered availability vulnerability.
Exploitation status
OffSeq's Threat Radar snapshot at November 10, 2026, 01:05 UTC reported the vulnerability as not known to be exploited, with no indexed public exploit in Metasploit or Exploit DB, no public Nuclei template, no CISA KEV listing and no attack traffic seen by its sensors. No threat actor, campaign or indicator set has been associated with this CVE. That is one provider's point-in-time view, and it does not change the published attack prerequisites.
Affected systems and versions
The CVE record lists the following SAP kernel version labels as affected:
- KRNL64NUC: 7.22, 7.22EXT
- KRNL64UC: 7.22, 7.53
- KERNEL: 7.22, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20, 9.21
These are discrete labels as published, not a continuous range, so do not assume every intervening release is affected. Fixed kernel patch levels are not available in the public record and are expected to be documented in the authenticated SAP Note 3805570.
The vulnerable configuration is a Message Server whose HTTP processing is reachable by an attacker. SAP documents several general Message Server exposure controls. They are hardening measures, not a confirmed workaround for this CVE:
- The
ACLFILEoption on the HTTP(S) listener inms/server_port_<xx>, which requires an existing ACL file with correct syntax. - Per-port network ACLs that control which hosts may open Message Server connections.
ms/permission_tablefor HTTP URL access authorizations. If the parameter is unset or the file is unavailable, no access control applies through this mechanism. An existing but empty file denies all HTTP access with 403.ms/acl_info, which restricts application server logon sources but does not affect external clients that only retrieve information, so it should not be treated as protection for the HTTP path.
SAP also notes that dynamic parameter changes are lost when the Message Server restarts. Because this vulnerability ends in a framework restart, persist any configuration change in the profile.
Vendor security history
SAP SE, founded in 1972 and headquartered in Walldorf, Germany, builds enterprise software spanning ERP, finance, procurement, supply chain, manufacturing, human resources and analytics.
A relevant prior case is CVE-2025-31324, an unrestricted file upload flaw in SAP NetWeaver Visual Composer Framework 7.50 rated CVSS 3.1 10.0. CISA added it to the Known Exploited Vulnerabilities Catalog on April 29, 2025 based on evidence of active exploitation, and Singapore's Cyber Security Agency reported that SAP released an emergency security update. That issue allowed unauthenticated upload of executable files with potential remote code execution, a materially different failure mode and component from the availability-only Message Server issue discussed here. It is background only and is not evidence that CVE-2026-120010 is being exploited.
SAP publishes security notes on the second Tuesday of each month through its Security Patch Day process and also delivers NetWeaver security fixes through support packages.
References
- NVD: CVE-2026-120010
- CVE Record: CVE-2026-120010
- SAP Note 3805570 (SAP for Me sign in required)
- SAP Security Patch Day
- SAP Security Notes and News
- SAP Help Portal: Security Settings for the SAP Message Server
- SAP Help Portal: Profile Parameters of the SAP Message Server
- MITRE CWE-131: Incorrect Calculation of Buffer Size
- OffSeq Threat Radar: CVE-2026-120010
- CISA: Adds One Known Exploited Vulnerability to Catalog (CVE-2025-31324)
- CSA Singapore: Active Exploitation of SAP NetWeaver Visual Composer Metadata Uploader
- CSA Singapore: Critical Vulnerabilities in SAP Products
- SAP Company Information
- What is SAP?
