RFC Memory Corruption: CVE-2026-76966 · CVE-2026-109796 · CVSS 3.0 8.9 · SAP Note 3769130
Note 3769130 fixes two kernel-level issues in RFC handling on AS ABAP. The main one, CVE-2026-76966, is a memory corruption that a crafted RFC request can trigger. Specifically, it abuses logic errors in memory management. It needs no authentication, and SAP rates the confidentiality and integrity impact as high: CVSS 8.9. In addition, CVE-2026-109796 (4.3) lets a low-privileged user read uninitialised memory. In this post, we cover the RFC Memory Corruption issue: exposure, the fix and what to check.
RFC Memory Corruption: affected kernels
The note lists kernels 7.22, 7.53, 7.54, 7.77, 7.93, 8.04 and 9.16 to 9.20. The fix for the RFC Memory Corruption improves RFC protocol validation in the kernel. FAQ note 3774165 has background.
Exposure
Anything that can reach the Gateway or dispatcher RFC ports (33xx, 32xx, 48xx with SNC) can attempt this attack. High attack complexity in the vector suggests that reliable exploitation is not trivial. However, attackers historically weaponise unauthenticated RFC bugs once details become public.
What to do
Patch the kernel, because there is no workaround for this issue. If you are already rolling out the kernel for this month’s Gateway and ICM HotNews notes, this fix comes with it. In addition, check firewall rules so that only systems that need them can reach RFC ports.
Why network rules matter
Many landscapes still allow RFC traffic from entire user networks. Consequently, every laptop becomes a possible source for this attack. Restricting the ports to known application servers and interface hosts therefore reduces risk for this and future RFC bugs.
RFC Memory Corruption: advisory details
Component: BC-MID-RFC
SAP priority: High
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 6
CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Source: SAP Security Note 3769130 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
