{"id":"CVE-2026-76963","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-76963","generatedAt":"2026-10-28T13:12:03.014Z","title":"Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information.","description":"Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected.","published":"2026-09-08T01:17:55.000Z","lastModified":"2026-09-08T19:13:00.000Z","status":"Awaiting Analysis","sourceIdentifier":"cna@sap.com","cvss":{"version":"3.1","score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-862"],"affected":[],"epss":{"score":0.00281,"percentile":0.2046,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://me.sap.com/notes/3772838","source":"cna@sap.com"},{"url":"https://url.sap/sapsecuritypatchday","source":"cna@sap.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-76963","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}