Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-76965 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | SAP |
| Product | NetWeaver Application Server ABAP |
| Vulnerability Type | missing authorization, OS command execution (CWE-749) |
| SAP Note | 3792735 |
| CVSS Score | 9.9 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD, SAP
SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on the underlying host. Successful exploitation could impact resources beyond the vulnerable component, resulting in a high impact on confidentiality, integrity and availability of the system.
The flaw was published as part of the November 2026 SAP Security Patch Day. The attack requires an account with low privileges.
Required Actions
- Apply the fix from SAP Note 3792735 (SAP Security Patch Day, November 2026).
- Review dialog and technical accounts with broad authorizations as well as unused accounts, since any account with system access is a potential entry point.
- Monitor OS command execution triggered from the ABAP system and unusual processes started by the SAP system user on the host.
Who Is Affected?
This vulnerability affects SAP NetWeaver Application Server ABAP. NVD provides no CPE configuration; affected versions and support packages are listed in SAP Note 3792735 (requires an SAP for Me account). SAP systems are mainly used by mid-sized and large enterprises (ERP, S/4HANA, NetWeaver platforms), so also check systems operated by partners and service providers.
The same Patch Day covered eight other critical SAP flaws: CVE-2026-109795, CVE-2026-109798, CVE-2026-109803, CVE-2026-120017, CVE-2026-76964, CVE-2026-89103, CVE-2026-89119, CVE-2026-89126.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-76965 vulnerability?
CVE-2026-76965 is a vulnerability in SAP NetWeaver Application Server ABAP — missing authorization, OS command execution — rated CVSS 9.9 (critical severity). SAP released a fix in Note 3792735 as part of the November 2026 SAP Security Patch Day.
Does exploiting CVE-2026-76965 require authentication?
According to the vendor's CVSS assessment, the attack requires an account with low privileges. The attack is carried out over the network.
How to protect against CVE-2026-76965?
Apply the fix from SAP Note 3792735 and, until it is deployed, restrict network access to the affected component. The note lists affected versions and any available workarounds.
Who is affected by CVE-2026-76965?
It affects organizations running SAP NetWeaver Application Server ABAP, typically mid-sized and large enterprises with SAP ERP or S/4HANA and the related NetWeaver components.
