Is CVE-2026-66767 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66767 being exploited in the wild.

How severe is CVE-2026-66767?

High severity, with a CVSS score of 7.7, published 8 September 2026.

Is there a fix for CVE-2026-66767?

A patch was published on 2026-09-08: Patches available via SAP Security Notes as part of SAP Security Patch Day Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66767 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-66767?

Check whether you run SAP NetWeaver Application Server for ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66767: SAP NetWeaver Application Server session hijacking via buffered request reprocessing

CVE-2026-66767 · Severity: high · CVSS 7.7 · Published 2026-09-08

SAP NetWeaver Application Server for ABAP and ABAP Platform is a core enterprise application server used to run mission-critical business processes. An unauthenticated attacker can send a specially crafted network packet to trick the server into reprocessing a previously buffered request from another user, potentially taking over their session. Successful exploitation could allow an attacker to impersonate legitimate users and access sensitive business data or modify critical information.

Technologies: SAP NetWeaver Application Server for ABAP. Vendors: SAP.

Quick answers

Is CVE-2026-66767 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66767 being exploited in the wild.
How severe is CVE-2026-66767?: High severity, with a CVSS score of 7.7, published 8 September 2026.
Which products and versions are affected?: SAP NetWeaver Application Server for ABAP <UNKNOWN>.
Is there a fix for CVE-2026-66767?: A patch was published on 2026-09-08: Patches available via SAP Security Notes as part of SAP Security Patch Day Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66767 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-66767?: Check whether you run SAP NetWeaver Application Server for ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a request hijacking issue in SAP NetWeaver Application Server for ABAP that allows an unauthenticated attacker to trigger reprocessing of a previously buffered user request via a specially crafted network packet. The attack relies on narrow timing conditions to intercept and replay a victim's session state, resulting in unauthorized access to their authenticated session. The vulnerability has high impact on confidentiality and integrity (user data exposure and modification), with low impact on availability. The attack vector is network-based and requires no authentication, though successful exploitation depends on precise timing to coincide with a victim's active session. Patches are available via SAP Security Notes as part of the September 8, 2026 SAP Security Patch Day.

Affected products

SAP NetWeaver Application Server for ABAP <UNKNOWN>
SAP ABAP Platform <UNKNOWN>

Timeline

2026-09-08: disclosed
2026-09-08: patched: Patches available via SAP Security Notes as part of SAP Security Patch Day

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.