Back
CVE-2026-76963
Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform
Medium4.3EPSS 0.28%
- Published
- Updated
- Reserved
- Assigned by
- sap
Description
Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| sapCNA (assigner) | 3.1 | Medium4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| NVDNVD · Awaiting Analysis | 3.1 | Medium4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.28% · top 79% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Weakness
Affected products
SAP_SE · SAP NetWeaver and ABAP Platform
- affected SAP_BASIS 700
- affected SAP_BASIS 701
- affected SAP_BASIS 702
- affected SAP_BASIS 731
- affected SAP_BASIS 740
- affected SAP_BASIS 750
- affected SAP_BASIS 751
- affected SAP_BASIS 752
- affected SAP_BASIS 753
- affected SAP_BASIS 754
- affected SAP_BASIS 755
- affected SAP_BASIS 756
- affected SAP_BASIS 757
- affected SAP_BASIS 758
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-76963)Record last updated .