CVE-2026-120010
Last modified
CVE-2026-120010 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality.
Description
SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality. Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on availability of the system. There is no impact on confidentiality and integrity of the application.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP NetWeaver Application Server (SAP Message Server) | KRNL64NUC 7.22; 7.22EXT; KRNL64UC 7.22; 7.53; KERNEL 7.22; 7.54; 7.77; 7.93; 9.16; 9.18; 9.20; 9.21 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-120010?
How severe is CVE-2026-120010?
How do I fix CVE-2026-120010?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1200A flaw was found in the rgaufman/live555 fork of live555. A …6.3
- CVE-2026-12000The Page and Post Restriction plugin for WordPress is vulner…7.5
- CVE-2026-120007NodeBB 1.18.0 through 4.16.5 contains an authorization bypas…6.5
- CVE-2026-120008SAP NetWeaver (Internet Graphics Service) does not sufficien…8.2
- CVE-2026-120009SAP ABAP Developer Tools (AMDP Data Preview) does not perfor…7.2
- CVE-2026-12001A hardcoded credential vulnerability exists in the firmware …5.2
- CVE-2026-120014SAP HANA XSA Web Dispatcher does not perform sufficient requ…7.6
- CVE-2026-120015SAP Host Agent does not sufficiently validate certain inputs…7.5
- CVE-2026-120016SAP NetWeaver Visual Composer does not perform sufficient in…6.1
- CVE-2026-120017SAP NetWeaver AS ABAP and ABAP Platform does not perform suf…10
- CVE-2026-120019The W3 Total Cache plugin for WordPress is vulnerable to Sto…5.4
- CVE-2026-12002The Smash Balloon Social Photo Feed – Easy Social Feeds Plug…4.7
Are you affected by CVE-2026-120010?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST