A missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform lets a low-privileged attacker run arbitrary operating system commands on the underlying host. It has a CVSS 3.1 score of 9.9 (Critical).
What Is It
CVE-2026-76965 affects SAP NetWeaver Application Server ABAP and ABAP Platform. According to SAP's CNA description, the product skips required authorization checks for certain internal functionality. An authenticated attacker with low privileges can call that functionality and execute arbitrary operating system commands on the host.
The weakness is classified as CWE-749 (Exposed Dangerous Method or Function). The NVD record has been published and its status is currently "Received."
Why It Matters
SAP rates this flaw 9.9 out of 10 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable with low attack complexity
- Needs only low privileges and no user interaction
- Scope changed: a successful exploit can affect resources beyond the vulnerable component
- High impact on confidentiality, integrity and availability
Running OS commands on the host of an SAP application server gives an attacker a foothold below the application layer. The CVSS vector rates the privileges required as low, and the CNA description says an authenticated low-privilege attacker can reach the affected functionality. The available data does not say which roles or authorizations an account needs to get there, so it is not established that every low-privilege account can exploit the flaw.
There is no CISA KEV entry for this CVE in the supplied data, so active exploitation has not been confirmed through KEV at this time.
What's Vulnerable
SAP lists the following versions of SAP NetWeaver and ABAP Platform as affected:
- KRNL64NUC 7.22
- KRNL64UC 7.22
- KERNEL 7.22
- 7.22EXT
- 7.53
- 7.54
- 7.77
- 7.93
- 9.16
The default status for versions not listed is "unaffected." No CPE entries are available in the NVD record yet.
Patch Status
SAP points to SAP Note 3792735 and its Security Patch Day portal for this vulnerability. The supplied data does not list specific fixed versions or a required action. Administrators of affected systems should:
- Review SAP Note 3792735 (requires an SAP support login) and apply the fix it describes
- Check the SAP Security Patch Day page for related updates
Because CISA KEV has no entry, there is no federal remediation deadline for this CVE.
Sources
- NVD, CVE-2026-76965
- SAP Note 3792735
- SAP Security Patch Day
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)