SAP NetWeaver Denial of Service (3805681)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a denial of service vulnerability as referenced in SAP Security Note 3805681: - SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not sufficiently handle resource consumption when...

SAP NetWeaver Multiple Vulnerabilities (3769130)

The version of the SAP NetWeaver kernel detected on the remote host is affected by multiple vulnerabilities as referenced in SAP Security Note 3769130: - Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an...

CVE-2026-76973

Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt acti...

CVE-2026-76966

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high...

CVE-2026-76970

Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memory corruption condition in the parsing...

CVE-2026-76965

SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on the underlying host. Successful...

CVE-2026-120017

SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged...

CVE-2026-109811

An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform Application Server ABAP has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitiv...

CVE-2026-109805

Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication...

CVE-2026-109794

SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not sufficiently handle resource consumption when processing certain requests. An unauthenticated attacker could send specially crafted requests to the affected component, causing excessive resource utilization and...

CVE-2026-109796

SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on...

CVE-2026-109805 Weak Cryptography in SAP NetWeaver and ABAP Platform (Application Server ABAP)

Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication...

EUVD-2026-120703

Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication...

CVE-2026-109805 Weak Cryptography in SAP NetWeaver and ABAP Platform (Application Server ABAP)

Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication...

CVE-2026-109805

SAP NetWeaver and ABAP Platform (Application Server ABAP) are affected by a vulnerability caused by a weak HMAC cryptography calculation during the processing of an RFC callback . An authenticated attacker with high privileges and access to the network segment between application servers can inte...

EUVD-2026-120700

SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged...

CVE-2026-120017 Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)

SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged...

CVE-2026-120017

SAP NetWeaver AS ABAP and ABAP Platform are vulnerable to an authentication bypass due to insufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker can submit specially crafted data to impersonate arbitrary users, including privilege...

CVE-2026-120017 Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)

SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged...

EUVD-2026-120693

An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform Application Server ABAP has SSRF vulnerability due to insecure default settings. An authenticated attacker with low privileges could trick the victim to interact with a malicious server which allows the attacker to access sensitiv...