Introduction
A newly disclosed flaw in the Internet Communication Manager (ICM) of SAP NetWeaver AS ABAP allows an unauthenticated attacker to send crafted network traffic that corrupts memory. The disclosed worst-case outcome is arbitrary code execution and full system compromise. SAP systems commonly support finance, procurement, human resources and supply chain operations, so a CVSS 3.1 score of 10.0 on a network-reachable component of the ABAP stack warrants prompt attention from SAP basis and security teams.
The supplied CVE data lists the vendor as Unknown, but the authoritative CVE record identifies SAP SE and lists eight affected version entries. In this post we summarize what has been disclosed, what has not, and where the current evidence on exploitation stands.
Technical information
Root cause
According to the CVE record, an internal component of SAP NetWeaver AS ABAP (Internet Communication Manager) does not sufficiently validate certain network input. When that input is specially crafted, it can trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system.
The weakness is classified as CWE-1287, Improper Validation of Specified Type of Input. MITRE defines this as a product that receives input expected to be of a certain type but does not validate, or incorrectly validates, that the input actually is of that type. CWE-1287 describes the validation failure, not the resulting memory corruption primitive. The public record does not say whether the corruption is a heap overflow, a use-after-free or something else.
Severity vector
SAP, acting as the CVE Numbering Authority, published the following vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Broken down:
- AV:N: exploitable over the network
- AC:L: low attack complexity
- PR:N: no privileges required
- UI:N: no user interaction required
- S:C: changed scope, meaning impact extends beyond the vulnerable component
- C:H / I:H / A:H: high impact on confidentiality, integrity and availability
The 10.0 Critical rating is SAP's CNA score. NVD had not yet provided its own assessment in the retrieved record, so this should not be presented as an independent NIST score, nor as evidence that exploitation has occurred.
Attack flow as disclosed
Based solely on the vendor description, the exploitation sequence looks like this:
- The attacker reaches the affected ICM functionality over the network. No credentials are needed.
- The attacker sends specially crafted network traffic containing input that the internal component expects to be of a particular type.
- The component fails to properly validate the type of that input (CWE-1287).
- Processing the malformed input triggers memory corruption.
- Successful exploitation results in arbitrary code execution and full compromise of the system, with the changed scope indicating effects beyond the ICM component itself.
What has not been disclosed
The accessible material does not reveal the protocol involved, the listening port, the packet structure, the vulnerable function, the memory corruption subtype or a working exploitation procedure. No exploit code or packet recipe has been published. Any claim about specific HTTP request handling or a particular primitive would be speculation at this point.
Exploitation status
As of reporting published on 10 November 2026:
- StackFlag labels the CVE as not known to be exploited.
- TheHackerWire reports no confirmed public exploit code and no known ransomware campaign, and states that the CVE is not recorded in the CISA KEV catalog (a tracker observation rather than direct CISA confirmation).
- TheHackerWire shows the EPSS evaluation as still in progress. A pending EPSS score is not the same as a low probability.
- No threat actor, country or campaign has been attributed to this vulnerability.
The disclosure establishes high potential impact. The available reporting does not establish confirmed operational use.
Affected systems and versions
The product is SAP NetWeaver AS ABAP (Internet Communication Manager). The complete CVE record lists the following eight entries, shown with package labels only where the record displays them:
- KRNL64UC 7.53
- KERNEL 7.53
- 7.54
- 7.77
- 7.93
- 9.16
- 9.18
- 9.20
The NVD page initially displays only five of these eight entries. The CVE.org record provides the fuller inventory.
The remediation reference for these versions is SAP Security Note 3778530, linked from both the CVE record and NVD. The note sits behind SAP for Me authentication, so exact corrected builds, prerequisites and any official workaround were not visible in public material. SAP states that security fixes for NetWeaver-based products are also delivered through support packages, but no specific support package for this CVE was identified in the reviewed sources. As interim measures, StackFlag advises limiting network access to trusted sources and monitoring for unusual network traffic. This is third-party guidance, not a verified SAP workaround, and it does not remove the vulnerability.
Vendor security history
SAP publishes security corrections as SAP Security Notes on Security Patch Day, the second Tuesday of every month, and recommends implementing them as a priority.
The most relevant prior case is CVE-2025-31324, a missing authorization check in the SAP NetWeaver Visual Composer Metadata Uploader:
- Rapid7 reports that SAP published the CVE on 24 April 2025, while exploitation in customer environments was observed from at least 27 March 2025. Attackers used the flaw to upload malicious files and deploy webshells. Rapid7 did not attribute its observed activity to a specific actor.
- Unit 42 reports exploitation to deploy JSP webshells in mid-March 2025, followed by a variety of attacks after public disclosure.
- The Cyber Security Agency of Singapore documented an out-of-band SAP security update, active exploitation and a CVSS 10.0 rating affecting Visual Composer Framework 7.50.
Both issues carry CVSS 10.0, but the mechanisms differ. CVE-2025-31324 is an authorization and file upload flaw, while CVE-2026-76964 is an input validation issue leading to memory corruption in ICM. The historical case does not establish a shared root cause, exploit or actor. It does show that attackers have actively targeted SAP NetWeaver before, in that case ahead of public disclosure.
References
- NVD: CVE-2026-76964
- CVE Record: CVE-2026-76964
- SAP Security Note 3778530 (SAP for Me, authentication required)
- SAP Security Patch Day
- SAP Security Notes and News
- MITRE CWE-1287: Improper Validation of Specified Type of Input
- StackFlag: CVE-2026-76964
- TheHackerWire: CVE-2026-76964 Analysis
- CVETodo: SAP NetWeaver AS ABAP Internet Communication Manager
- SAP SE Company Information
- Rapid7: Active Exploitation of SAP NetWeaver Visual Composer CVE-2025-31324
- Unit 42: Threat Brief on CVE-2025-31324
- Cyber Security Agency of Singapore: Active Exploitation of SAP NetWeaver Visual Composer Metadata Uploader
- CISA: Adds One Known Exploited Vulnerability to Catalog (April 2025)
