Low severity · published Feb 10, 2026
CVE-2026-24320
Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)
3.1
CVSS
0.3%
EPSS
No
On KEV
Description
Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver and ABAP Platform (Application Server ABAP) · SAP_SE
KRNL64NUC 7.22; 7.22EXT; KRNL64UC 7.22; 7.53; 8.04; KERNEL 7.22; +7 more · source: vendor
NA
Netweaver AS Abap Kernel · Sap
7.22; 7.54; 7.77; 7.89; 7.93; 9.16; +2 more · source: NVD
NA
Netweaver AS Abap Krnl64nuc · Sap
7.22; 7.22ext · source: NVD