CVE-2026-76970

Due to a memory corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. Triggering the vulnerability could cause the server to crash and disrupt active connections.

SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user can send specially crafted requests that trigger an error in internal processing, potentially crashing the affected work process and making the system unavailable.

SAP NetWeaver Application Server ABAP and ABAP Platform do not properly initialize memory in certain internal components. Under specific conditions, a low-privileged attacker could disclose uninitialized memory contents.

SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling. An unauthenticated attacker could send a specially crafted request to cause the affected process to become unavailable. This results in a high impact on availability, with no impact on confidentiality and integrity.

SAP NetWeaver Application Server ABAP and ABAP Platform do not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke the affected functionality to execute arbitrary operating system commands on the underlying host.

SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger memory corruption, potentially leading to arbitrary code execution and full system compromise.

SAP NetWeaver Application Server ABAP is vulnerable to logical errors in DIAG protocol parsing, allowing an unauthenticated attacker to cause memory corruption. This could potentially disclose sensitive system information or crash the system, leading to high impact on confidentiality, integrity, and availability.

An authenticated attacker can exploit logical errors in memory management in SAP NetWeaver Application Server ABAP, causing memory corruption. This could lead to unauthorized data access, modification, or system unavailability.

SAP NetWeaver Application Server ABAP and ABAP Platform allow an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, leading to unauthorized access to sensitive user data and potential disruption of normal system usage.

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on confidentiality and integrity and no impact on availability.