SAP NetWeaver ABAP EUVD-2026-72576

Network access to the SAP NetWeaver AS ABAP request-processing endpoint (ICM HTTP/RFC layer) is required. No authentication is required from the attacker (PR:N per CVSS). Exploitation is constrained by a mandatory race condition: the crafted packet must be received during a narrow timing window when another user's request is buffered server-side, requiring a concurrent victim session in an appropriate state. The description does not indicate any non-default configuration requirement - the vulnerability appears to affect default AS ABAP deployments. Limiting factors: AC:H race condition makes reliable exploitation difficult and precludes fully automated mass exploitation; a live victim session must be present simultaneously. There is no user interaction requirement on the attacker's side (UI:N), but a victim must be actively using the system.

The CVSS 3.1 score of 7.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) captures the tension between an unauthenticated network vector and a high-complexity race condition. AC:H is the primary risk governor: reliable exploitation requires the crafted packet to arrive within a narrow window coinciding with an active victim session whose request is buffered, making opportunistic or scanning-based mass exploitation impractical. No EPSS score, CISA KEV listing, or public POC was provided; no evidence of active exploitation exists at time of analysis. Despite the complexity barrier, SAP NetWeaver AS ABAP hosts financials, HR, and supply chain data, making it a prioritized target for sophisticated nation-state or financially motivated actors willing to invest in timing-precise attacks. The wildcard CPE version range implies the vulnerable population spans all deployed AS ABAP versions, amplifying aggregate exposure. CVSS C:H and I:H accurately reflect session takeover consequences; A:L aligns with the vendor's 'low impact on availability' characterization.

An unauthenticated attacker continuously sends specially crafted packets to the SAP NetWeaver AS ABAP ICM or request-processing endpoint while concurrent legitimate user sessions are active; when the crafted packet arrives during the narrow window in which a victim user's request is buffered, the integer underflow causes the server to reprocess the victim's buffered request bound to the attacker's connection, granting the attacker access to the victim's ABAP session, authorizations, and business data. No public exploit code has been identified at time of analysis, and reliable exploitation requires precise timing coordination, making this more feasible for targeted attacks than opportunistic campaigns.