SAP has disclosed a critical flaw in its NetWeaver software that carries the maximum severity score, after the vulnerability was published to the CVE List on 10 November 2026. Tracked as CVE-2026-76964, the flaw lets an attacker with no login at all send specially crafted network traffic to a vulnerable system and run their own code on it, potentially taking it over completely.

What the flaw does

According to the US National Vulnerability Database (NVD), SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, with a high impact on the confidentiality, integrity and availability of the system.

The weakness is classified as CWE-1287, improper validation of a specified type of input. The affected component is the Internet Communication Manager of NetWeaver AS ABAP, which handles network traffic coming into the system, and that is what makes the flaw so serious: it can be reached remotely, needs no username or password, and needs no action from a victim.

How severe is CVE-2026-76964

SAP, as the assigning authority for the CVE, published a CVSS vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which works out to the maximum score of 10.0. In plain terms, the attack works over the network, is not hard to carry out, needs no privileges and no user interaction, and can affect resources beyond the vulnerable component. The NVD has not yet published its own assessment of the flaw, so the 10.0 figure is SAP's scoring at this stage.

There is no confirmed public exploit code for CVE-2026-76964 at this time, and it is not recorded in the US CISA Known Exploited Vulnerabilities catalogue. That does not make it safe to ignore: NetWeaver systems have been a repeated target for attackers in recent years, and critical flaws in the platform are routinely scanned for once they become public.

A second critical flaw disclosed alongside it

A second flaw in the same disclosure, CVE-2026-76965, is nearly as severe. SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorisation checks for certain internal functionality, so an attacker with low privileges could invoke that functionality to execute arbitrary operating system commands on the underlying host. SAP's scoring puts it at 9.9. Unlike the first flaw, this one needs the attacker to hold a low-privileged account first, but the outcome, full command execution on the host, is just as serious.

Which systems are affected

The NVD lists affected versions including KRNL64UC 7.53 and KERNEL 7.53, 7.54, 7.77 and 7.93 for CVE-2026-76964, with further versions named in the full record. For CVE-2026-76965, affected versions include kernel releases 7.22 and 7.53. Administrators should check SAP Security Note 3778530 for the first flaw and Note 3792735 for the second, as well as SAP's Security Patch Day page, to confirm exactly which releases in their estate are affected and which patches apply.

What administrators should do

Organisations running SAP NetWeaver should apply the vendor patches as a priority, starting with internet-facing systems. Where patching cannot happen immediately, network access to the affected components should be restricted to trusted hosts only, and systems should be monitored for unusual activity. SAP customers should also review whether any of their systems are running the affected kernel versions, since the flaw sits in the kernel-level components rather than in a single application.