CVE-2026-76968

mediumpriority · track · 26EPSS 0.004 · 33 %ileNL

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.39% (33rd) EPSS

CVSS 6.5 · medium

Is it mine?

20 products

Check your exposure

Who says so?

1 sources

ncsc_nl

EPSS · scored 2026-10-27

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed information could potentially be used to facilitate further attacks. This vulnerability has a high impact on the confidentiality of the application, with no impact on integrity or availability.

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · cna@sap.comexploitability 2.8 · impact 3.6

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-497USCWE-497US

affected products (20)

Products and version ranges known to be affected.

SAP Content Server, Internet Communication Manager, Web Dispatcher≤ vers:unknown/*ncsc_nlNL
SAP Extended Passport Processing≤ vers:unknown/*ncsc_nlNL
SAP GUI for Java≤ vers:unknown/*ncsc_nlNL
SAP Integration Suite≤ vers:unknown/*ncsc_nlNL
SAP Manufacturing Integration and Intelligence≤ vers:unknown/*ncsc_nlNL
SAP NetWeaver≤ vers:unknown/*ncsc_nlNL
SAP NetWeaver Business Client≤ vers:unknown/*ncsc_nlNL
SAP NetWeaver Message Server≤ vers:unknown/*ncsc_nlNL
SAP S4HANA≤ vers:unknown/*ncsc_nlNL
SAP SAP Software≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP ABAP Developer Tools≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Cloud Application Programming Model (CAP)≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Extended Passport (EPP) Processing≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Integration Suite≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Manufacturing Integration and Intelligence≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP NetWeaver (Message Server)≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP NetWeaver (SAP GUI for Java)≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP NetWeaver Business Client≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP S/4HANA (Intercompany Matching and Reconciliation)≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Web Dispatcher, Internet Communication Manager and SAP Content Server≤ vers:unknown/*ncsc_nlNL

advisories (1)

Vendor and ecosystem advisories describing this.

NCSC-2026-0356Kwetsbaarheden verholpen in diverse SAP-productenNL2026-09-09csaf · ncsc_nlNL
SAP heeft kwetsbaarheden verholpen in SAP Extended Passport Protocol (EPP) processing library, SAP NetWeaver Message Server, @sap/cds-mtxs NPM library, SAP GUI for Java, SAP ABAP Development Tools voor SAP NetWeaver AS ABAP, SAP Integration Suite, SAP NetWeaver Business Client, SAP Web Dispatcher, Internet Communication Manager, SAP Content Server, SAP S/4HANA Intercompany Matching and Reconciliation module, en SAP Manufacturing Integration and Intelligence.

sources

Which sources assert this record, and when.

ncsc_nl NVD CVE.org MITRE

published 2026-09-08modified 2026-09-08

references (2) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan