CVE-2026-24320

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24320", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-01-21T22:15:36.672Z", "datePublished": "2026-02-10T03:03:42.731Z", "dateUpdated": "2026-02-10T16:25:30.720Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SAP NetWeaver and ABAP Platform (Application Server ABAP)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "KRNL64NUC 7.22"}, {"status": "affected", "version": "7.22EXT"}, {"status": "affected", "version": "KRNL64UC 7.22"}, {"status": "affected", "version": "7.53"}, {"status": "affected", "version": "8.04"}, {"status": "affected", "version": "KERNEL 7.22"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.89"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}, {"status": "affected", "version": "9.17"}, {"status": "affected", "version": "9.18"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability.</p>"}], "value": "Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-113", "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers", "lang": "eng", "type": "CWE"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:03:42.731Z"}, "references": [{"url": "https://me.sap.com/notes/3678313"}, {"url": "https://url.sap/sapsecuritypatchday"}], "source": {"discovery": "UNKNOWN"}, "title": "Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T16:25:22.928517Z", "id": "CVE-2026-24320", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:25:30.720Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24320", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T16:25:22.928517Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:25:27.792Z"}}], "cna": {"title": "Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP NetWeaver and ABAP Platform (Application Server ABAP)", "versions": [{"status": "affected", "version": "KRNL64NUC 7.22"}, {"status": "affected", "version": "7.22EXT"}, {"status": "affected", "version": "KRNL64UC 7.22"}, {"status": "affected", "version": "7.53"}, {"status": "affected", "version": "8.04"}, {"status": "affected", "version": "KERNEL 7.22"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.89"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}, {"status": "affected", "version": "9.17"}, {"status": "affected", "version": "9.18"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3678313"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability.", "supportingMedia": [{"type": "text/html", "value": "<p>Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-113", "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-02-10T03:03:42.731Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24320", "state": "PUBLISHED", "dateUpdated": "2026-02-10T16:25:30.720Z", "dateReserved": "2026-01-21T22:15:36.672Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-02-10T03:03:42.731Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP NetWeaver and ABAP Platform (Application Server ABAP)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "KRNL64NUC 7.22"}, {"status": "affected", "version": "7.22EXT"}, {"status": "affected", "version": "KRNL64UC 7.22"}, {"status": "affected", "version": "7.53"}, {"status": "affected", "version": "8.04"}, {"status": "affected", "version": "KERNEL 7.22"}, {"status": "affected", "version": "7.54"}, {"status": "affected", "version": "7.77"}, {"status": "affected", "version": "7.89"}, {"status": "affected", "version": "7.93"}, {"status": "affected", "version": "9.16"}, {"status": "affected", "version": "9.17"}, {"status": "affected", "version": "9.18"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.22:*:*:*:*:*:*:*", "matchCriteriaId": "FE603A80-8FF0-4180-9E11-C468AE2441C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.54:*:*:*:*:*:*:*", "matchCriteriaId": "7F5D31D3-B2B2-4347-B8DF-D06056289598", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.77:*:*:*:*:*:*:*", "matchCriteriaId": "50570852-982E-40CA-B391-3FB8B9373F78", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.89:*:*:*:*:*:*:*", "matchCriteriaId": "B8B74AD9-A83E-45DD-96C2-4F3C8C8C6AE6", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:7.93:*:*:*:*:*:*:*", "matchCriteriaId": "237DBA4A-B5A9-48C9-B6A3-D293BB66EF69", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:9.16:*:*:*:*:*:*:*", "matchCriteriaId": "3668B2D9-0A4C-43F5-B248-9A6438AF7D71", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:9.17:*:*:*:*:*:*:*", "matchCriteriaId": "FB41121A-3D27-460C-A9AF-A1573F1F4568", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_kernel:9.18:*:*:*:*:*:*:*", "matchCriteriaId": "1BC9779B-7571-44F7-BCCC-6BF2834ED779", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64nuc:7.22:*:*:*:*:*:*:*", "matchCriteriaId": "02507EB2-8776-4EA9-9164-B2F6AD911B59", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64nuc:7.22ext:*:*:*:*:*:*:*", "matchCriteriaId": "7867ADA5-47AA-48DD-9CAC-D3ACB5713CB3", "vulnerable": true}, {"criteria": "cpe:2.3:a:sap:netweaver_as_abap_krnl64uc:7.22:*:*:*:*:*:*:*", "matchCriteriaId": "B5E3292A-7311-4821-A52E-8FB4A1449D44", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability."}, {"lang": "es", "value": "Debido a una gesti\u00f3n de memoria inadecuada en SAP NetWeaver y ABAP Platform (Servidor de Aplicaciones ABAP), un atacante autenticado podr\u00eda explotar errores l\u00f3gicos en la gesti\u00f3n de memoria al proporcionar una entrada especialmente dise\u00f1ada que contiene caracteres \u00fanicos, los cuales se convierten de forma incorrecta. Esto podr\u00eda resultar en corrupci\u00f3n de memoria y la posible fuga de contenido de la memoria. La explotaci\u00f3n exitosa de esta vulnerabilidad tendr\u00eda un bajo impacto en la confidencialidad de la aplicaci\u00f3n, sin efecto en su integridad o disponibilidad."}], "id": "CVE-2026-24320", "lastModified": "2026-06-17T10:22:53.887", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "cna@sap.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24320", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T16:25:22.928517Z", "version": "2.0.3"}}]}, "published": "2026-02-10T04:16:03.990", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3678313"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-113"}], "source": "cna@sap.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "KRNL64NUC 7.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.22EXT"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "KRNL64UC 7.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.53"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8.04"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "KERNEL 7.22"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.54"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.77"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.89"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.93"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.18"}}], "product": "sap_netweaver_and_abap_platform_(application_server_abap)", "vendor": "sap_se"}], "analysis": {"en": {"generated_at": "2026-04-17T20:56:56.311029+00:00", "value": {"mitigation_remediation": ["Apply the SAP NetWeaver security patch referenced in SAP Note 3678313", "Restrict privileged user accounts and enforce least\u2011privilege access to limit the ability to submit crafted input", "Implement input validation controls or enable defensive checks to detect and reject malformed or uniquely\u2011characterized requests before they reach the kernel"], "summary": {"action": "Apply Patch", "impact": "Low-Level Memory Corruption (confidentiality leakage)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects SAP NetWeaver and ABAP Platform (Application Server ABAP) across multiple kernel versions, including 7.22, 7.54, 7.77, 7.89, 7.93, 9.16, 9.17, 9.18, as well as 64\u2011bit kernel variants of 7.22.", "description_and_impact": "Improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP) allows an authenticated attacker to supply specially crafted input containing unique characters that are improperly converted. This flaw leads to memory corruption and the possible leakage of memory content, yielding a low impact on confidentiality while not affecting integrity or availability.", "risk_and_exploitability": "The CVSS vector assigns a score of 3.1, indicating low overall severity, and the EPSS score is reported as less than 1%, meaning exploitation probability is very low at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session to the application, where the attacker can execute specially crafted requests to trigger logical memory errors. The weakness corresponds to CWE\u2011113 and CWE\u2011787, emphasizing improper input handling and potential buffer overflows."}}}}, "created": "2026-02-10T11:34:38.901959+00:00", "updated": "2026-04-17T21:00:12.724232+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$sap_netweaver_and_abap_platform_(application_server_abap)"]}