SAP NetWeaver AS ABAP Internet Communication Manager memory corruption allows unauthenticated code execution (CVE-2026-76964)

What happened

The CVE record describes a memory corruption condition in the Internet Communication Manager (ICM) of SAP NetWeaver Application Server ABAP. SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker can send specially crafted network traffic to trigger the condition. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, with high impact on confidentiality, integrity and availability.

Under the CVSS 3.1 vector, the attack is reachable over the network, has low attack complexity, requires no privileges and no user interaction, and has a changed scope. The CVE record does not indicate active exploitation or public disclosure, and no vendor statement on exploitation is recorded.

Who is affected

The affected component is the Internet Communication Manager in SAP NetWeaver Application Server ABAP. The CVE record lists these affected releases: KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20.

SAP has not listed a fixed version or workaround. An organisation running any of these releases should treat the Internet Communication Manager as affected until SAP states otherwise.

What to do now

No fixed version or vendor workaround is listed in the CVE record, so containment and monitoring are the immediate actions.

1. Check whether your SAP ABAP application servers run one of the named releases: KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 or 9.20.
2. Restrict network access to the Internet Communication Manager. Remove internet exposure and limit reachability to trusted internal systems, management networks or defined business partners.
3. Monitor the SAP security note referenced for this CVE and the SAP Security Patch Day pages for a fixed release or workaround.
4. Increase monitoring on affected SAP hosts for unexpected commands, new processes or unusual outbound connections until SAP publishes a fixed version.

How to detect it

The CVE record does not provide vendor-specific indicators of compromise or host-based signatures. Begin with an exposure check: identify Internet Communication Manager ports that are reachable from untrusted networks and investigate accidental internet exposure. Until SAP publishes detection guidance, treat unusual network traffic to ICM and unexpected process or command activity on SAP application servers as a prompt to investigate.

Beyond the patch

An unauthenticated, network-reachable memory corruption flaw in an SAP component makes exposure the first risk to rule out. Our Virtual CISO Services (vCISO) can help map and reduce reachability to the Internet Communication Manager. If code execution occurs, the post-exploitation activity is what Managed Detection & Response (MDR) detects across EDR and SIEM. Our SAP HANA Security & Cloud Migration practice supports SAP-specific hardening and prioritisation.