CVE-2026-120010
Received Received - Intake

Heap Buffer Overflow in SAP NetWeaver Application Server

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality. Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on availability of the system. There is no impact on confidentiality and integrity of the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-120010
EUVD
EUVD-2026-120696

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap netweaver_application_server *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-131 The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP NetWeaver Application Server (Message Server) has a flaw where memory allocations are not properly sized for certain HTTP requests. An unauthenticated attacker can exploit this by sending a specially crafted request to cause a heap buffer overflow. This leads to the component crashing and becoming unavailable until manually restarted, severely impacting system availability.

Detection Guidance

Detecting this vulnerability requires monitoring SAP NetWeaver Application Server (Message Server) for crashes or restarts after handling HTTP requests. Check system logs for heap buffer overflow errors or unexpected service terminations. Use SAP tools like SAPControl or transaction SMICM to inspect message server status and logs.

Impact Analysis

This vulnerability can cause the SAP Message Server to crash and remain down until restarted, disrupting access to the application server. It does not compromise data confidentiality or integrity but results in significant downtime and operational disruption for affected systems.

Compliance Impact

The vulnerability primarily impacts availability, which may violate compliance requirements for system uptime and reliability in standards like GDPR or HIPAA. Downtime could lead to non-compliance penalties if critical services are disrupted.

Mitigation Strategies

Apply the latest security patches from SAP as soon as possible. Monitor SAP NetWeaver Application Server logs for unusual HTTP requests or crashes. Restrict network access to the SAP Message Server to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120010. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...