{"affected":[{"defaultStatus":"unaffected","product":"SAP NetWeaver and ABAP Platform","source":"CNA: sap","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.53"},{"status":"affected","version":"8.04"},{"status":"affected","version":"KERNEL 7.22"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.18"},{"status":"affected","version":"9.20"}]}],"cveId":"CVE-2026-76966","cwes":["CWE-294"],"description":"Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on confidentiality and integrity with low impact on availability of the application.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.9,"severity":"high","source":"CNA: sap","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","version":"3.1"}],"modifiedAt":1794269868510,"publishedAt":1794269868510,"references":[{"source":"CNA: sap","tags":[],"url":"https://me.sap.com/notes/3769130"},{"source":"CNA: sap","tags":[],"url":"https://url.sap/sapsecuritypatchday"}],"remediation":[],"revision":"f6dd187238c2feb10c8a111ab546d12ac37a6f63bbee8a55b4722700963d2aa9","sources":[{"modifiedAt":1794269868510,"name":"CNA: sap","retrievedAt":1794272973902,"url":"https://www.cve.org/CVERecord?id=CVE-2026-76966"}],"ssvc":null,"status":"published","title":"Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform","updatedAt":1794272973902}