EUVD-2026-72576
GHSA-42j4-4hwf-257g
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Network-reachable with no authentication required, but AC:H reflects the mandatory race-condition timing window; C:H/I:H for full session takeover, A:L per vendor description.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
4DescriptionCVE.org
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the application.
AnalysisAI
Session hijacking in SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated remote attacker to assume another authenticated user's session by exploiting an integer underflow that causes a previously buffered request to be reprocessed in the wrong connection context. The attack is constrained by a narrow race-condition timing window requiring a victim session to be in a buffered state simultaneously, limiting mass exploitation but not targeted attacks against high-value SAP landscapes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Network access to the SAP NetWeaver AS ABAP request-processing endpoint (ICM HTTP/RFC layer) is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) captures the tension between an unauthenticated network vector and a high-complexity race condition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the correction referenced in SAP Security Note 3757002 (https://me.sap.com/notes/3757002) via SAP's standard Support Package or Security Patch Day process; exact fixed version identifiers require authenticated access to SAP One Support and were not independently verifiable from public references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct a complete inventory of all SAP NetWeaver ABAP and ABAP Platform systems and prioritize those hosting mission-critical business processes; enable detailed session logging to capture connection context and session lifecycle events. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-191 – Integer Underflow
View allShare
External POC / Exploit Code
Leaving vuln.today