Is CVE-2026-76973 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76973 being exploited in the wild.

How severe is CVE-2026-76973?

High severity, with a CVSS score of 7.5, published 10 November 2026.

Which products and versions are affected?

SAP NetWeaver; SAP ABAP Platform.

Is there a fix for CVE-2026-76973?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-76973 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-76973?

Check whether you run SAP ABAP Platform or SAP NetWeaver. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76973: SAP NetWeaver Application Server ABAP memory corruption denial of service

CVE-2026-76973 · Severity: high · CVSS 7.5 · Published 2026-11-10

A memory corruption flaw in SAP NetWeaver and ABAP Platform's Application Server allows unauthenticated attackers to crash the server by sending specially crafted network requests. This causes a denial of service by disrupting active user connections and bringing down critical business applications that depend on the platform. While the immediate impact is loss of availability, successful exploitation could also serve as a foothold for further attacks on the enterprise infrastructure.

Technologies: SAP ABAP Platform, SAP NetWeaver. Vendors: SAP.

Quick answers

Is CVE-2026-76973 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76973 being exploited in the wild.
How severe is CVE-2026-76973?: High severity, with a CVSS score of 7.5, published 10 November 2026.
Which products and versions are affected?: SAP NetWeaver; SAP ABAP Platform.
Is there a fix for CVE-2026-76973?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-76973 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76973?: Check whether you run SAP ABAP Platform or SAP NetWeaver. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory corruption vulnerability in the ABAP Application Server component of SAP NetWeaver and ABAP Platform can be exploited over the network by an unauthenticated attacker sending specially crafted requests. The vulnerability allows an attacker to trigger a server crash, resulting in denial of service and termination of active connections. No authentication or user interaction is required for exploitation.

Affected products

SAP NetWeaver
SAP ABAP Platform

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.