Brief Summary: SAP NetWeaver AS ABAP CVE-2026-76965, Missing Authorization Checks Leading to OS Command Execution

Introduction

SAP has disclosed a critical flaw in the ABAP Application Server for SAP NetWeaver and ABAP Platform that lets an attacker holding only low privileges run arbitrary operating system commands on the underlying host. ABAP systems sit underneath finance, procurement, HR and supply chain processes in many large enterprises, so a path from a low-privileged account to host command execution on these servers deserves careful attention from SAP basis and security teams.

SAP, acting as the CNA, rates CVE-2026-76965 at CVSS 3.1 9.9 (Critical) and tracks the correction in SAP Security Note 3792735. In this brief summary we walk through what the public record establishes and what it does not.

Technical information

Root cause: missing authorization on exposed internal functionality

The official title of the issue is "OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP Platform." According to the CNA description, the product does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges can invoke that functionality and execute arbitrary operating system commands on the underlying host.

The weakness is classified as CWE-749, Exposed Dangerous Method or Function. MITRE defines this as an interface that contains a dangerous method or function that is not properly restricted. MITRE also notes that exposing critical functionality can effectively hand an attacker the privilege level of that functionality, with consequences that depend on what the function does. In this case, the function's behavior ends in OS command execution on the host running the ABAP stack.

Authorization, not authentication

For triage purposes, the disclosed weakness concerns what an already authenticated, low-privileged user can invoke. It is not a documented authentication bypass. Neither the CNA description nor the CVSS vector supports describing this as an unauthenticated attack. Any account that meets the low-privilege bar on an affected system is the relevant starting point.

CVSS 3.1 assessment

SAP's published vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector: Network. On its own, this does not establish public Internet exposure.
Attack Complexity: Low.
Privileges Required: Low.
User Interaction: None.
Scope: Changed. Impact can extend to resources beyond the vulnerable component.
Confidentiality, Integrity, Availability: High / High / High.

This is SAP's CNA score. At the time of writing, NVD lists its own assessment as not yet provided, and the NVD record status is Received.

Attack flow as described in the public record

The sequence the public record supports is short:

The attacker holds low-privileged access to an affected SAP NetWeaver AS ABAP or ABAP Platform system reachable over the network.
The attacker invokes the affected internal functionality, which does not enforce the necessary authorization check.
That functionality executes attacker-supplied operating system commands on the underlying host.
Because scope is changed, the resulting confidentiality, integrity and availability impact can extend beyond the ABAP component itself.

The public record does not name the transaction, function module, service endpoint, protocol, port, authorization object, payload or command syntax involved. It also does not state which operating system account the commands run as. We have deliberately not filled those gaps with speculation. The details sit behind SAP's restricted note.

Exploitation status

In the reviewed sources, active exploitation of CVE-2026-76965 is not publicly confirmed. No threat actor is named, no confirmed public exploit code was identified, and no indicators of compromise were published. The reviewed CISA KEV feed (catalog version 2026.11.09, released November 9, 2026) predates the NVD publication on November 10, 2026, so the lack of a KEV entry says little either way. The 9.9 score describes assessed severity rather than observed attack activity.

Affected systems and versions

The CNA record lists nine affected version strings for SAP NetWeaver Application Server ABAP and ABAP Platform. We reproduce them exactly as published, without expanding bare version labels into inferred product families:

KRNL64NUC 7.22
7.22EXT
KRNL64UC 7.22
7.53
KERNEL 7.22
7.54
7.77
7.93
9.16

These are affected release identifiers, not corrected builds. The public record does not provide patch-level thresholds that would tell you whether a given installation within one of these releases already carries the correction. That determination has to come from SAP Security Note 3792735, which requires SAP for Me sign in. SAP's general guidance is to access Security Notes in SAP for Me, select All Security Notes, and implement corrections as a priority. SAP also states that NetWeaver security fixes are delivered with support packages, though no specific package is publicly tied to this CVE.

Publication timeline: the CNA record was published on November 10, 2026 at 00:17:29 UTC, and the NVD entry followed on November 10, 2026 at 01:17:20.

Vendor security history

SAP SE, headquartered in Walldorf, Germany and founded on April 1, 1972, describes itself as a global leader in enterprise applications and business AI. CIO reporting on IDC research from June 2024 placed SAP and Salesforce in a statistical tie for the top position in the worldwide enterprise applications market for 2023.

The most relevant recent precedent is the 2025 Visual Composer incident, a different NetWeaver component:

CVE-2025-31324 affected the Visual Composer development server (VCFRAMEWORK 7.50) and allowed unauthenticated arbitrary file upload. Canada's Cyber Centre reports active exploitation since March 2025, with an SAP emergency update on April 24, 2025. CISA added it to the KEV catalog.
CVE-2025-42999, a deserialization vulnerability, was addressed in an SAP advisory on May 13, 2025. The Cyber Centre states that this second patch removed residual risk that remained after patching CVE-2025-31324. CISA also lists active exploitation evidence for it.

In that case, the first correction did not close all related exposure. That history does not imply the same dependency, attack chain or residual risk for CVE-2026-76965, and the two issues are technically distinct (missing authorization leading to OS command execution versus unauthenticated file upload and deserialization). It does reinforce the value of confirming the exact applicable note rather than assuming an earlier or unrelated SAP update covers this flaw. SAP publishes regular corrections on its Security Patch Day, the second Tuesday of each month.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical information