CVE-2026-76965
SAP NetWeaver ABAP OS command injection lets low-privileged attackers run commands (CVE-2026-76965)
SAP NetWeaver Application Server ABAP and ABAP Platform lack authorization checks for internal functionality. A low-privileged network attacker can execute OS commands with high impact on confidentiality, integrity and availability. No fixed release is listed for CVE-2026-76965.
What happened
The CVE record describes a missing authorization check in certain internal functionality of the ABAP Application Server used by SAP NetWeaver and ABAP Platform. An attacker who already has a low-privileged account can call that functionality over the network and use it to execute arbitrary operating system commands on the host running the application server.
Successful exploitation compromises the host rather than an isolated application. The CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H: reachable from the network, low attack complexity, low privileges required, no user interaction, changed scope, with high impact on confidentiality, integrity and availability. The score is 9.9, critical. The CWE identifier is CWE-749.
The CVE record does not record exploitation or public disclosure for this flaw.
Who is affected
The affected product is SAP NetWeaver and ABAP Platform. The affected versions listed in the CVE record are KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.54, 7.77 and 7.93. These values correspond to ABAP application server kernels, so teams should check the kernel version on each ABAP application server rather than only the application layer.
What to do now
- Confirm whether you run one of the affected SAP NetWeaver or ABAP Platform kernel versions: KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.54, 7.77 or 7.93.
- Treat this as a critical unpatched condition. The CVE record does not list a fixed version or workaround, so no patch guidance is available yet.
- Restrict network access to ABAP application servers so that only trusted internal users and systems can reach the affected functionality.
- Review low-privilege accounts and remove unnecessary roles or authorizations. Exploitation requires a low-privileged account, so reducing standing privilege narrows exposure.
- Monitor hosts running these kernels for unexpected OS-level command execution.
- Track SAP Security Patch Day and the SAP note referenced on this page for a fixed release. No fixed version is listed in the CVE record at publication.
How to detect it
No vendor indicators of compromise are published in the CVE record. Because the flaw allows command injection, defenders should watch for unexpected operating-system processes spawned by SAP work processes on affected hosts. SAP security audit logs may also show unusual internal function calls from low-privileged users; investigate those against the affected host.
Beyond the patch
An SAP estate is usually business-critical, and this flaw turns a low-privileged account into host-level control. Beyond this advisory, knowing which SAP kernels you run and how quickly you can respond when a fix lands is the real control. Our SAP HANA Security & Cloud Migration practice works directly on SAP estates, and Supply Chain Defense & Third-Party Risk helps you track vendor patch cycles and exposure windows so a critical unpatched issue is identified early.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| SAP NetWeaver and ABAP Platform | KRNL64NUC 7.22 7.22EXT KRNL64UC 7.22 7.53 KERNEL 7.22 7.54 7.77 7.93 | No fixed version listed yet |