SAP has disclosed CVE-2026-76964, a CVSS 10.0 flaw in the Internet Communication Manager (ICM) of SAP NetWeaver AS ABAP that could let an unauthenticated remote attacker execute arbitrary code and fully compromise the system.
What Is It
According to the NVD record, SAP NetWeaver Application Server ABAP does not properly validate certain network input handled by an internal component. An unauthenticated attacker can send specially crafted network traffic that causes memory corruption in the affected code. If exploitation succeeds, the attacker can run arbitrary code and fully compromise the system.
SAP, acting as the CNA, classifies the weakness as CWE-1287 (Improper Validation of Specified Type of Input). The CVE has only just been published, and its NVD status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
SAP scores the flaw CVSS 3.1 10.0 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable: the attacker needs no local access.
- Low complexity: no special conditions are required.
- No privileges and no user interaction: the attacker needs no credentials, and no user has to do anything.
- Changed scope: the impact can extend beyond the vulnerable component.
- High impact on confidentiality, integrity and availability.
The ICM is the component that handles network communication for AS ABAP. Its exposure makes this a high-priority issue for any organization running affected kernels.
Exploitation status: the sources cited here do not report active exploitation. They also do not say whether CISA has added this CVE to its Known Exploited Vulnerabilities catalog. Defenders should check the KEV catalog directly for current status and any remediation deadline.
What's Vulnerable
The affected product is SAP NetWeaver AS ABAP (Internet Communication Manager). The vendor lists these versions as affected:
- KRNL64UC 7.53
- KERNEL 7.53
- 7.54
- 7.77
- 7.93
- 9.16
- 9.18
- 9.20
All other versions default to "unaffected" according to the CNA data. NVD has not yet published any CPE entries.
Patch Status
SAP's references point to SAP Security Note 3778530 and to the SAP Security Patch Day portal. The supplied data does not list fixed kernel levels or workarounds. Administrators should:
- Check SAP Note 3778530 for the corrected kernel patch levels and any interim mitigations.
- Inventory their ABAP systems against the affected kernel versions above.
- Put internet-facing and other broadly reachable ICM instances first, because the flaw requires no authentication and can be triggered over the network.