CVE-2026-66767: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

CVE-2026-66767 is a session hijacking vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an unauthenticated attacker to send a specially crafted packet triggering reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Affected kernel versions include KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, 8.04, KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19, and 9.20. The vulnerability was published on September 8, 2026, with a patch advisory referenced under SAP Security Note 3757002. It carries a CVSS v3.1 base score of 7.7 (High) (Github Advisory).

The root cause is classified as CWE-191 (Integer Underflow / Wrap or Wraparound), where a subtraction operation produces a result below the minimum allowable integer value, leading to incorrect behavior in request buffer management. An unauthenticated remote attacker can exploit this by sending a specially crafted network packet that causes the server to reprocess a previously buffered user request, effectively inserting the attacker's packet into another user's session context. Exploitation requires precise timing (high attack complexity), as the race condition window is narrow — no user interaction or privileges are required. No public proof-of-concept code has been identified at the time of publication (Github Advisory).

Successful exploitation results in session hijacking, granting the attacker access to another authenticated user's session and all associated privileges and data. The confidentiality and integrity impacts are rated High, as the attacker can read and potentially modify data accessible to the hijacked session, while availability impact is Low. Depending on the privileges of the hijacked session, exploitation could expose sensitive business data, enable unauthorized transactions, or facilitate lateral movement within SAP environments (Github Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code at this time. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires meeting narrow timing conditions (high attack complexity), which reduces the practical risk compared to simpler vulnerabilities (Github Advisory).

SAP has published Security Note 3757002 addressing this vulnerability; organizations should consult the SAP Support Portal for patch availability and apply the relevant kernel updates for their affected versions (KRNL64NUC, KRNL64UC, KERNEL across versions 7.22 through 9.20). As interim measures, restrict network-level access to SAP NetWeaver Application Server endpoints where possible, and monitor for suspicious session activity or unexpected request reprocessing patterns. Organizations should follow SAP's Security Patch Day guidance for prioritized remediation (Github Advisory).