SAP NetWeaver CVE-2026-76964: Critical Unauthenticated Remote Code Execution Vulnerability With CVSS 10.0

SAP NetWeaver Vulnerability CVE-2026-76964 Could Allow Unauthenticated Remote Code Execution

A critical security vulnerability in SAP NetWeaver Application Server ABAP could allow remote attackers to execute arbitrary code without authentication, potentially resulting in complete system compromise.

Tracked as CVE-2026-76964, the vulnerability was published on 10 November 2026 and carries a maximum CVSS v3.1 score of 10.0 (Critical).

The issue involves insufficient validation of network input processed by an internal component of SAP NetWeaver AS ABAP. An attacker with network access could send specially crafted traffic to trigger memory corruption in the affected functionality.

Successful exploitation could enable arbitrary code execution, affecting the confidentiality, integrity and availability of the compromised system.

The vulnerability is associated with CWE-1287 (Improper Validation of Specified Type of Input). SAP has published Security Note 3778530 to address the issue.

Security teams responsible for SAP environments should review their kernel versions, identify potentially exposed components and prioritise the applicable security updates.

1. Understanding CVE-2026-76964

CVE-2026-76964 affects the Internet Communication Manager (ICM) within SAP NetWeaver Application Server ABAP.

The ICM is responsible for handling incoming and outgoing HTTP and HTTPS communications between SAP applications and external clients. It plays an important role in processing web requests and supporting communication between users, applications and SAP services.

The vulnerability occurs because the affected functionality does not sufficiently validate certain network input.

An unauthenticated attacker who can reach the relevant network service could submit specially crafted traffic that triggers memory corruption.

Depending on successful exploitation, this condition could allow an attacker to execute arbitrary code and gain extensive control over the affected SAP system.

Unlike vulnerabilities requiring stolen credentials or user interaction, the published CVSS vector indicates that this issue requires neither authentication nor user interaction.

Key vulnerability details

2. How the Vulnerability Works

CVE-2026-76964 is associated with improper validation of network input, which can lead to memory corruption.

The technical investigation published by Onapsis Research Labs identifies the underlying issue as a problem in how the SAP Kernel processes WebSocket traffic.

WebSocket is a communication protocol that enables continuous, two-way communication between a client and a server. It is commonly used in interactive web applications and services.

During communication, WebSocket messages can be divided into smaller fragments before being reassembled by the receiving application.

According to the Onapsis technical advisory, the vulnerability occurs during this message-reassembly process.

A specially crafted sequence of WebSocket messages can cause the affected component to write attacker-controlled data beyond the memory allocated for a connection.

This can produce memory corruption. Depending on how the memory is affected, the outcome may include a process crash or arbitrary operating system command execution.

The research team also reported that it had demonstrated working unauthenticated remote code execution to SAP during the responsible disclosure process.

The issue is particularly important because the vulnerable functionality is part of the SAP Kernel communication infrastructure rather than an isolated application feature.

3. Why the Vulnerability Creates a Serious Security Risk

Several characteristics make CVE-2026-76964 particularly concerning for enterprise environments.

Unauthenticated exploitation

The CVSS vector specifies that attackers do not need existing credentials to exploit the vulnerability.

Network accessibility

The attack vector is network-based. An attacker who can reach the relevant service may be able to target the vulnerable functionality remotely.

Potential remote code execution

Successful exploitation could allow arbitrary code execution, potentially giving attackers extensive control over the affected system.

Impact across the CIA triad

The vulnerability carries high potential impact across all three fundamental cybersecurity principles:

• Confidentiality: Unauthorised access to sensitive information.

• Integrity: Unauthorised modification of system data or operations.

• Availability: Disruption or loss of access to affected services.

These characteristics are reflected in the published CVSS vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4. Affected SAP Components and Kernel Versions

The published vulnerability information identifies multiple SAP Kernel releases affected by CVE-2026-76964.

The affected versions include:

Organisations should verify their installed kernel release and patch level against SAP Security Note 3778530.

The Onapsis advisory also identifies older, unsupported kernel releases as affected. These include versions 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89.

The advisory states that these older releases may not receive a direct fix and may require an upgrade to a supported compatible kernel release.

SAP NetWeaver AS Java is not affected according to the technical advisory. However, dual-stack
installations containing an ABAP stack are affected.

5. Security Fixes and Recommended Mitigation

SAP Security Note 3778530 addresses CVE-2026-76964.

Organisations should review the official SAP security guidance and apply the appropriate corrected kernel patch levels.

The Onapsis advisory identifies the following fixed patch levels:

These are the patch levels identified in the technical advisory. Administrators should verify the latest applicable corrections and release-specific instructions through SAP before deployment.

Recommended actions for security teams

1. Identify affected systems: Inventory SAP NetWeaver AS ABAP installations and determine their kernel versions.

2. Review patch levels: Compare installed versions with the corrected releases listed in SAP Security Note 3778530.

3. Prioritise network-accessible systems: Assess systems where the relevant HTTP or HTTPS services are reachable from untrusted networks.

4. Review WebSocket usage: Identify applications and integrations that depend on WebSocket communication before considering temporary configuration changes.

5. Apply security updates: Install the applicable SAP corrections following the vendor's deployment guidance.

6. Review legacy installations: Assess unsupported kernel versions and plan upgrades to supported releases where required.

7. Monitor suspicious activity: Review relevant SAP application and infrastructure logs for unusual communication patterns or unexpected process behaviour.

6. Temporary Workarounds for Organisations Unable to Patch Immediately

The Onapsis advisory describes two temporary mitigation approaches documented in SAP FAQ Note 3778788.

These measures should not be treated as permanent replacements for the official security corrections.

Using an updated SAP Web Dispatcher

Certain higher Web Dispatcher patch levels can protect backend systems accessed exclusively through that dispatcher.

However, this protection has limitations. Backend systems that remain directly accessible may not receive the same protection. The workaround also does not apply when the dispatcher uses the specified PROT=ROUTER configuration.

Disabling WebSocket support

Another temporary approach involves disabling WebSocket upgrade support through the following parameter:

icm/HTTP/support_websocket_upgrade=FALSE

The affected component must be restarted for the configuration change to take effect.

However, disabling WebSocket support can affect interactive applications and integrations that depend on it.

SAP's guidance recommends reviewing WebSocket activity before implementing this change.

Administrators can inspect ICM or Web Dispatcher HTTP logs for requests returning status code 101, which indicates a protocol upgrade.

Organisations should assess the operational impact and consult the relevant SAP documentation before applying either workaround.

7. What This Means for Enterprise SAP Security

CVE-2026-76964 highlights the security importance of underlying application infrastructure.

SAP communication components handle traffic that connects enterprise applications with users, services and external systems. Vulnerabilities in these components can therefore create risks beyond individual application functionality.

For organisations operating SAP environments, the announcement reinforces the need for continuous kernel maintenance, accurate asset inventories and timely security patch management.

The issue also demonstrates why security assessments should include infrastructure components that may not be directly visible to business users.

Analysis: The development highlights a broader industry shift towards treating enterprise application infrastructure as a critical part of the security perimeter. For organisations operating complex SAP landscapes, maintaining supported software versions and reviewing network exposure are essential elements of vulnerability management.

Conclusion

CVE-2026-76964 represents a critical security risk for organisations running affected SAP NetWeaver AS ABAP environments.

Its maximum CVSS 3.1 score of 10.0, lack of authentication requirements and potential for arbitrary code execution make it an important issue for SAP administrators and enterprise security teams.

SAP Security Note 3778530 provides the relevant correction guidance. Organisations should verify their kernel versions, review exposure and deploy the applicable security updates.

Where immediate patching is not possible, administrators should evaluate the temporary workarounds documented by SAP while planning permanent remediation.

For enterprise security teams, the priority is clear: identify affected systems, validate their patch status and reduce exposure to the vulnerable functionality.