{"api_version":"1","generated_at":"2026-11-10T17:31:29+00:00","cve":"CVE-2026-76970","urls":{"html":"https://cve.report/CVE-2026-76970","api":"https://cve.report/api/cve/CVE-2026-76970.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-76970","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76970"},"summary":{"title":"Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform","description":"Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could cause the affected processes to crash and restart. By repeatedly sending such requests, the attacker could cause a sustained denial of service, leading to a high impact on availability. Confidentiality and integrity remain unaffected.","state":"PUBLISHED","assigner":"sap","published_at":"2026-11-10 01:17:20","updated_at":"2026-11-10 01:17:20"},"problem_types":["CWE-787","CWE-787 CWE-787: Out-of-bounds Write"],"metrics":[{"version":"3.1","source":"cna@sap.com","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://url.sap/sapsecuritypatchday","name":"https://url.sap/sapsecuritypatchday","refsource":"cna@sap.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://me.sap.com/notes/3792915","name":"https://me.sap.com/notes/3792915","refsource":"cna@sap.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76970","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76970","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected KRNL64NUC 7.22","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected 7.22EXT","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected KRNL64UC 7.22","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected 7.22EX2","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected 7.22EX3","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected 7.53","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected 7.54","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected 7.77","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected 7.93","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected 8.04","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected 9.16","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected 9.18","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected 9.20","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected 9.21","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform","version":"affected KERNEL 7.22","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"SAP NetWeaver and ABAP Platform","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.22EX2"},{"status":"affected","version":"7.22EX3"},{"status":"affected","version":"7.53"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"8.04"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.18"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"},{"status":"affected","version":"KERNEL 7.22"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could cause the affected processes to crash and restart. By repeatedly sending such requests, the attacker could cause a sustained denial of service, leading to a high impact on availability. Confidentiality and integrity remain unaffected.</p>"}],"value":"Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could cause the affected processes to crash and restart. By repeatedly sending such requests, the attacker could cause a sustained denial of service, leading to a high impact on availability. Confidentiality and integrity remain unaffected."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","description":"CWE-787: Out-of-bounds Write","lang":"eng","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T00:18:08.996Z","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","shortName":"sap"},"references":[{"url":"https://me.sap.com/notes/3792915"},{"url":"https://url.sap/sapsecuritypatchday"}],"source":{"discovery":"UNKNOWN"},"title":"Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","assignerShortName":"sap","cveId":"CVE-2026-76970","datePublished":"2026-11-10T00:18:08.996Z","dateReserved":"2026-08-20T05:33:36.764Z","dateUpdated":"2026-11-10T00:18:08.996Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 01:17:20","lastModifiedDate":"2026-11-10 01:17:20","problem_types":["CWE-787","CWE-787 CWE-787: Out-of-bounds Write"],"metrics":{"cvssMetricV31":[{"source":"cna@sap.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"76970","Ordinal":"1","Title":"Memory Corruption vulnerability in Application Server ABAP for S","CVE":"CVE-2026-76970","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"76970","Ordinal":"1","NoteData":"Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing routine, which could cause the affected processes to crash and restart. By repeatedly sending such requests, the attacker could cause a sustained denial of service, leading to a high impact on availability. Confidentiality and integrity remain unaffected.","Type":"Description","Title":"Memory Corruption vulnerability in Application Server ABAP for S"}]}}}