Detections
Analytics
SAP NetWeaver Multiple Vulnerabilities (3769130)
high Nessus Plugin ID 379587
Synopsis
The remote SAP NetWeaver application server is affected by multiple vulnerabilities.Description
The version of the SAP NetWeaver kernel detected on the remote host is affected by multiple vulnerabilities as referenced in SAP Security Note 3769130:- Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on confidentiality and integrity with low impact on availability of the application. (CVE-2026-76966)
- SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability. (CVE-2026-109796)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Apply the appropriate patch according to the vendor advisory.See Also
Plugin Details
Severity: High
ID: 379587
File Name: sap_netweaver_kernel_3769130.nasl
Version: 1.1
Type: Remote
Family: Web Servers
Published: 11/12/2026
Updated: 11/12/2026
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7
Percentile: 97.91
CVSS v2
Risk Factor: High
Base Score: 7.3
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:P
CVSS Score Source: CVE-2026-76966
CVSS v3
Risk Factor: High
Base Score: 8.9
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Vulnerability Information
CPE: cpe:/a:sap:netweaver_application_server
Required KB Items: Settings/ParanoidReport, installed_sw/SAP Netweaver Application Server (AS)
Patch Publication Date: 11/10/2026
Vulnerability Publication Date: 11/10/2026