← Vulnerability feed

Vulnerability record · CVE-2026-24320 · published 10 February 2026

CVE-2026-24320: Sap netweaver as abap kernel out-of-bounds write vulnerability

Sap · Netweaver As Abap Kernel

Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability.

3.1 CVSS 3.1 Low EPSS 0.25% · top 85.7% CWE-113 · CWE-113CWE-787 · Out-of-bounds write
3.1CVSS 3.1 base score
0.25%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://me.sap.com/notes/3678313 Permissions Required
https://url.sap/sapsecuritypatchday Vendor Advisory

Track CVE-2026-24320 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-27668Sap netweaver as abap incorrect authorization vulnerabilityDepending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProute…EPSS 2.2%9.6CVE-2026-0509Sap netweaver as abap kernel missing authorization vulnerabilitySAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls with…EPSS 0.35%7.5CVE-2022-29616Sap netweaver as abap kernel out-of-bounds write vulnerabilitySAP Host Agent, SAP NetWeaver and ABAP Platform allow an attacker to leverage logical errors in memory management to cause a memory corruption.EPSS 0.94%6.1CVE-2022-27656Sap netweaver as abap kernel cross-site scripting vulnerabilityThe Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, res…EPSS 0.56%

Source: NIST National Vulnerability Database (record CVE-2026-24320), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.