highInvestigating

SAP NetWeaver and ABAP Platform Kernel RFC Memory Corruption Vulnerability

Investigating(current)
Trending(upcoming)
Workaround available(upcoming)
Resolved(upcoming)

Executive summary

An unauthenticated attacker can exploit improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform. By sending a crafted RFC request, the attacker can trigger memory management logical errors, resulting in memory corruption that impacts confidentiality and integrity.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix

Technical root cause

Improper RFC protocol validation in the SAP Kernel leading to memory management logical errors and memory corruption.

Evidence

1 report · 1 CVEShow

[1]
CVE First report17 hours ago
SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker: CVE-2026-76966 (High)(opens security advisory in a new tab)
High severity. Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on confidentiality and integrity with low impact on availability of the application.
by Tenable 0upvotes 0comments

Timeline

First report on security advisoryNov 10, 01:17 UTC
SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker: CVE-2026-76966 (High)
Source