SAPFTP OS Command Injection: CVE-2026-76965 · CVSS 3.0 9.9 · SAP Note 3792735
SAPFTP is the kernel helper program that ABAP uses for FTP transfers. Normally, function group SFTP drives it. Note 3792735 fixes a gap in SAPFTP when someone calls it over RFC. In that case, commands not needed for file transfer were reachable, and so were local file paths outside the expected area. Consequently, a user with low privileges could run operating system commands on the application server. SAP rates the SAPFTP OS Command Injection at CVSS 9.9, HotNews. In this post, we cover exposure, the fix and what to check.
SAPFTP OS Command Injection: correction
The fix is in the kernel (7.22, 7.53, 7.54, 7.77, 7.93 and 9.16). SAP delivers it as SAPFTP.SAR or through the SP Stack Kernel. It closes this issue by restricting the command set over RFC and confining local file access. In addition, it needs no configuration. FAQ note 3807491 has more detail.
Workaround
Until you update the kernel, reduce this risk and remove authorizations that users do not strictly need. First, check S_RFC for function group SFTP (FTP_COMMAND, FTP_START_SAPFTP). Second, check S_C_FUNCT with CFUNCNAME = SYSTEM, ACTVT = 16 and PROGRAM = SAPLSFTP. These rarely belong to dialog users, so the change is usually low risk.
What to check
Run a user information system query for both authorization combinations above. Then list who has them, including RFC and batch users. After the kernel change closes the SAPFTP OS Command Injection, retest interfaces that use FTP from ABAP as well.
Why it ranks so high
Operating system access on an application server usually means access to the database and to every secret on the host. For that reason, the SAPFTP OS Command Injection is close to a full system takeover. Even so, the interim fix is cheap, because few users really need these authorizations.
SAPFTP OS Command Injection: advisory details
Component: BC-SRV-COM-FTP
SAP priority: HotNews
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 6
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: SAP Security Note 3792735 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
