A new high-severity flaw has been disclosed in SAP NetWeaver, the enterprise platform attackers are already hunting for weaknesses. The flaw, tracked as CVE-2026-120010, lets an unauthenticated attacker crash a core component of the system with a single crafted web request.

The vulnerability was published on 10 November 2026 and carries a CVSS score of 7.5, rated high. It affects the SAP NetWeaver Application Server, specifically its Message Server component, which routes messages between parts of an SAP system.

What the flaw does

SAP NetWeaver Application Server does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker can send a specially crafted request to trigger a heap buffer overflow in the affected functionality. The weakness is classified as CWE-131, an incorrect calculation of buffer size.

Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on the availability of the system. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning the attack works over the network, needs no login and no user interaction, and hits availability alone. There is no impact on the confidentiality or integrity of the application.

Why NetWeaver is a priority target

The disclosure lands while NetWeaver is under sustained attack. Security researchers reported on 10 November that internet honeypots are still seeing probes for webshells linked to an earlier NetWeaver flaw, CVE-2025-31324, a maximum-severity unauthenticated file-upload vulnerability that attackers have used to plant webshells on unpatched servers.

Ransomware groups have also joined the ongoing attacks on NetWeaver systems, exploiting the older flaw to gain remote code execution on vulnerable servers. A fresh flaw in the same platform, even one that only causes a crash, gives attackers another reason to scan for exposed NetWeaver installations.

What to do now

No public exploit code has been confirmed for CVE-2026-120010, and the flaw is not recorded in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue. That does not make it safe to ignore: the flaw is now public, the vulnerable code is identified, and NetWeaver is a proven target.

Organisations running SAP NetWeaver should apply the vendor's patches as soon as they are available, check SAP's security notes for the affected versions, and review whether their Message Server is reachable from the internet. Where internet exposure is not needed, it should be removed. Systems should also be monitored for unexpected restarts or crashes of the Message Server component, which could indicate probing.

The disclosure is a reminder that availability flaws matter as much as data theft in business-critical systems. A crashed Message Server can halt the SAP processes a company depends on, and in a platform attackers are already scanning, every new flaw shortens the time defenders have to patch.