Brief Summary: SAP NetWeaver Kernel CVE-2026-76966, Unauthenticated RFC Memory Corruption

Introduction

A single crafted RFC request, sent by an attacker with no credentials, can push the SAP Kernel underneath Application Server ABAP into corrupting its own memory. SAP rates the consequences as high impact to confidentiality and integrity across a dozen affected kernel release entries, which makes CVE-2026-76966 a data protection concern for SAP NetWeaver and ABAP Platform owners rather than just a stability issue.

SAP SE is both the affected vendor and the CVE Numbering Authority for this issue, and it scores the flaw at 8.9 (High) under CVSS v3.1. NVD lists the record with status Received and source [email protected]. The displayed score is SAP's assessment, and NIST has not published a separate one. In this post we summarize what the public record says, what it leaves out, and where the official remediation guidance lives.

Technical information

Root cause

The vulnerable functionality is the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform. SAP's description ties together three elements:

1. Improper RFC protocol validation, where the kernel does not adequately validate incoming RFC protocol data.
2. Logical errors in memory management, which a crafted request can exercise.
3. Memory corruption within the application server process, which results from the combination of the first two.

The public record does not identify the specific RFC operation, the message fields involved, the affected memory object, or the implementation function. It also does not describe a particular corruption primitive (for example, an out-of-bounds write or a use-after-free), and it does not explicitly confirm remote code execution. No vulnerable code has been published.

CVSS vector

SAP's published vector is:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

• Base score: 8.9, High
• Attack vector: Network
• Attack complexity: High
• Privileges required: None
• User interaction: None
• Scope: Changed
• Confidentiality: High
• Integrity: High
• Availability: Low

The combination of PR:N and AC:H means the attacker needs no account, but SAP judges successful exploitation to depend on conditions outside the attacker's direct control. The high-complexity rating should not be read as an authentication requirement. The impact profile is also weighted toward data, with high confidentiality and integrity impact and only low availability impact. The record does not explain what drives the high-complexity rating or the changed scope.

Attack flow as disclosed

Based solely on the official description, the exploitation sequence looks like this:

1. An unauthenticated attacker with network access to an affected Application Server ABAP instance constructs a crafted RFC request. No user interaction is needed.
2. The SAP Kernel receives and processes the request without adequate RFC protocol validation.
3. The malformed input reaches logical errors in the kernel's memory management.
4. Memory corruption occurs. SAP assesses the potential impact as high for confidentiality and integrity and low for availability, with a changed scope.

No request payload, reproducible procedure, or proof of concept has been published.

The CWE-294 classification

SAP assigns CWE-294, Authentication Bypass by Capture-replay. MITRE defines this weakness as a design that lets an attacker sniff network traffic and bypass authentication by replaying it, possibly with minor changes.

This does not line up neatly with the CVE narrative, which centers on protocol validation and memory corruption. The public record does not explain how the two relate. Our reading is that captured credentials, an observed authentication exchange, or a replayed session should not be treated as confirmed prerequisites for this CVE. For triage, the RFC memory corruption description and the full CVSS vector are the more reliable signals. The CWE label alone is not an exploitation recipe.

Exploitation status

As of the November 10, 2026 review, CVE-2026-76966 does not appear in the CISA Known Exploited Vulnerabilities JSON feed, and the official record names no threat actor or campaign. TheHackerWire reports that no public proof of concept has been detected or confirmed and that no ransomware campaign is linked. Those statements report missing confirmation. They are not evidence that exploitation has not occurred.

Affected systems and versions

The official CVE record identifies SAP NetWeaver and ABAP Platform (the SAP Kernel used by Application Server ABAP) and lists 12 affected entries. The labels below preserve the record's wording exactly:

1. KRNL64NUC 7.22
2. 7.22EXT
3. KRNL64UC 7.22
4. 7.53
5. 8.04
6. KERNEL 7.22
7. 7.54
8. 7.77
9. 7.93
10. 9.16
11. 9.18
12. 9.20

A few notes on interpreting this list:

• The entries span several kernel component labels and releases, so this is not limited to the newest kernel line.
• Unqualified entries (such as 7.53 or 9.20) are listed as published. We have not assigned them to a specific component family.
• The public record does not include corrected kernel build numbers. This list identifies affected entries, not the minimum fixed patch level.

The correction details are in SAP Security Note 3769130, which requires an SAP for Me login. The public URL only shows a sign-in page. SAP recommends implementing security corrections with priority and lists all notes in SAP for Me under All Security Notes. SAP publishes Security Notes on Security Patch Day, the second Tuesday of every month, and delivers NetWeaver security fixes through support packages, subject to its maintenance policy (support packages shipped within the preceding 24 months, and products in Mainstream or Extended Maintenance). That policy is general guidance and does not by itself identify which package resolves this CVE.

Vendor security history

The most relevant prior case is CVE-2025-31324, an unrestricted file upload vulnerability in SAP NetWeaver Visual Composer. On April 29, 2025, CISA added it to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Singapore's Cyber Security Agency described how unauthenticated attackers could upload malicious executable files, potentially leading to remote code execution.

The comparison has clear limits. CVE-2025-31324 concerns Visual Composer file upload handling, while CVE-2026-76966 concerns RFC validation and kernel memory corruption. The mechanisms, documented outcomes, and evidence maturity all differ, and mitigations for the Visual Composer issue cannot be carried over as a fix here. The earlier case does show that SAP NetWeaver vulnerabilities have progressed from disclosure to confirmed exploitation before, which is useful context when prioritizing SAP Security Notes.

References

• NVD: CVE-2026-76966
• CVE Record: CVE-2026-76966
• CVE Services API record for CVE-2026-76966
• NVD API record for CVE-2026-76966
• SAP Security Note 3769130 (SAP for Me login required)
• SAP Security Notes and News
• SAP Security Patch Day, September 2026
• CWE-294: Authentication Bypass by Capture-replay
• CISA Known Exploited Vulnerabilities feed (JSON)
• CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2025-31324)
• Cyber Security Agency of Singapore: Active Exploitation of SAP NetWeaver Visual Composer Metadata Uploader
• TheHackerWire: CVE-2026-76966 analysis
• SAP Corporate Fact Sheet, July 2026