CVE-2026-66767 Overview
CVE-2026-66767 affects SAP NetWeaver Application Server for ABAP and ABAP Platform. An unauthenticated remote attacker can send a specially crafted packet that triggers reprocessing of a previously buffered user request. Under narrow timing conditions, this behavior allows the attacker to hijack another authenticated user's session.
Successful exploitation grants high impact to confidentiality and integrity, with low impact on availability. The underlying weakness is classified as [CWE-191] Integer Underflow. SAP addressed the flaw in the SAP Security Patch Day release referenced by SAP Note #3757002.
Critical Impact
Unauthenticated attackers can hijack authenticated ABAP user sessions over the network, gaining access to sensitive business data and the ability to modify records within the target session context.
Affected Products
- SAP NetWeaver Application Server for ABAP
- SAP ABAP Platform
- Specific supported versions are enumerated in SAP Note #3757002
Discovery Timeline
- 2026-09-08 - CVE-2026-66767 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-66767
Vulnerability Analysis
The vulnerability resides in how SAP NetWeaver Application Server for ABAP handles buffered user requests at the network layer. A crafted packet triggers the server to reprocess a request previously queued for another authenticated session. When the timing window aligns, the reprocessed request executes in the context of the original user, exposing that user's session to an unauthenticated attacker.
The attack requires no privileges and no user interaction. High attack complexity reflects the narrow race window and the crafted packet structure needed to force reprocessing. The impact spans confidentiality and integrity because the attacker acts under a legitimate authenticated session, with limited disruption to service availability.
Root Cause
The root cause is an integer underflow ([CWE-191]) in request handling logic. Incorrect boundary arithmetic on a buffered request causes the server to mis-index into stored request state and reissue a previously received request. Because the buffered request retains the original session context, the reprocessed request inherits that user's authentication state.
Attack Vector
Exploitation occurs over the network against exposed SAP NetWeaver ABAP endpoints. The attacker crafts a packet that induces the server to reprocess buffered data belonging to a concurrent user session. No credentials are required. Because the flaw depends on a narrow timing condition, attackers must repeatedly probe the server to hit the vulnerable window.
No public proof-of-concept exploit is available at the time of publication. See SAP Note #3757002 for authoritative technical details.
Detection Methods for CVE-2026-66767
Indicators of Compromise
- Repeated malformed or unusually structured packets sent to SAP NetWeaver ABAP dispatcher ports from a single source
- Session activity originating from unexpected client IP addresses for authenticated users
- ABAP application log entries showing actions performed by users at times inconsistent with their normal working patterns
- Anomalous transaction execution ordering within short timing windows across concurrent sessions
Detection Strategies
- Monitor SAP Security Audit Log (SM20) for unexpected session reuse and unusual RFC or dialog activity
- Correlate authentication events with source IP changes for the same session identifier
- Alert on high-frequency crafted packets targeting SAP dispatcher ports (sapdp**, sapms**) from unauthenticated sources
- Baseline normal request timing distributions and flag statistical deviations suggesting race-condition probing
Monitoring Recommendations
- Enable full SAP Security Audit Log coverage for dialog, RFC, and HTTP logon events
- Forward SAP application and gateway logs to a centralized SIEM for correlation with network telemetry
- Deploy network monitoring in front of SAP application servers to capture and inspect dispatcher-bound traffic
- Review web dispatcher and Internet Communication Manager (ICM) trace files for repeated protocol anomalies
How to Mitigate CVE-2026-66767
Immediate Actions Required
- Apply the SAP-provided patch referenced in SAP Note #3757002 as soon as a maintenance window permits
- Restrict network exposure of SAP NetWeaver ABAP dispatcher and ICM ports to trusted internal segments only
- Enforce SAP Web Dispatcher and reverse proxy filtering in front of Internet-facing SAP application servers
- Review recent authentication and transaction logs for signs of anomalous session reuse
Patch Information
SAP released the fix during SAP Security Patch Day. Refer to SAP Note #3757002 for the authoritative patch, affected support package levels, and version-specific remediation instructions. Additional context is available on the SAP Security Patch Day portal.
Workarounds
- No official workaround has been published; SAP directs administrators to apply the patch
- Reduce attack surface by limiting network reachability of SAP NetWeaver ABAP systems to authenticated VPN or bastion access
- Enable mutual TLS or SNC (Secure Network Communications) between clients and SAP servers where supported to raise the bar for crafted-packet delivery
- Increase logging verbosity temporarily to detect probing attempts against the vulnerable code path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
