{"api_version":"1","generated_at":"2026-11-10T17:31:30+00:00","cve":"CVE-2026-76973","urls":{"html":"https://cve.report/CVE-2026-76973","api":"https://cve.report/api/cve/CVE-2026-76973.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-76973","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76973"},"summary":{"title":"Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (SAP Message Server)","description":"Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected.","state":"PUBLISHED","assigner":"sap","published_at":"2026-11-10 01:17:20","updated_at":"2026-11-10 01:17:20"},"problem_types":["CWE-190","CWE-190 CWE-190: Integer Overflow or Wraparound"],"metrics":[{"version":"3.1","source":"cna@sap.com","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://url.sap/sapsecuritypatchday","name":"https://url.sap/sapsecuritypatchday","refsource":"cna@sap.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://me.sap.com/notes/3789273","name":"https://me.sap.com/notes/3789273","refsource":"cna@sap.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76973","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76973","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected KRNL64NUC 7.22","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected 7.22EXT","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected KRNL64UC 7.22","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected 7.53","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected 8.04","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected KERNEL 7.22","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected 7.54","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected 7.77","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected 7.93","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected 9.16","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected 9.18","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected 9.20","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","version":"affected 9.21","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"SAP NetWeaver and ABAP Platform (SAP Message Server)","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.53"},{"status":"affected","version":"8.04"},{"status":"affected","version":"KERNEL 7.22"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.18"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected.</p>"}],"value":"Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-190","description":"CWE-190: Integer Overflow or Wraparound","lang":"eng","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T00:18:25.840Z","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","shortName":"sap"},"references":[{"url":"https://me.sap.com/notes/3789273"},{"url":"https://url.sap/sapsecuritypatchday"}],"source":{"discovery":"UNKNOWN"},"title":"Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (SAP Message Server)","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","assignerShortName":"sap","cveId":"CVE-2026-76973","datePublished":"2026-11-10T00:18:25.840Z","dateReserved":"2026-08-20T05:33:36.764Z","dateUpdated":"2026-11-10T00:18:25.840Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 01:17:20","lastModifiedDate":"2026-11-10 01:17:20","problem_types":["CWE-190","CWE-190 CWE-190: Integer Overflow or Wraparound"],"metrics":{"cvssMetricV31":[{"source":"cna@sap.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"76973","Ordinal":"1","Title":"Memory Corruption vulnerability in Application Server ABAP of SA","CVE":"CVE-2026-76973","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"76973","Ordinal":"1","NoteData":"Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected.","Type":"Description","Title":"Memory Corruption vulnerability in Application Server ABAP of SA"}]}}}