Message Server Memory Corruption: CVE-2026-76973 · CVSS 3.0 7.5 · SAP Note 3789273
The Message Server is the single point every AS ABAP instance and logon group depends on. Note 3789273 fixes two of its endpoints. One has an integer overflow, while the other has a buffer overflow. As a result, an unauthenticated attacker who reaches the Message Server could crash it and drop active connections. SAP rates the Message Server Memory Corruption at CVSS 7.5, High. In this post, we cover exposure, the fix and what to check.
Message Server Memory Corruption: affected kernels
The note lists 7.22 (including EXT), 7.53, 7.54, 7.77, 7.93, 8.04 and 9.16 to 9.21. Deploy it through the SP Stack Kernel (SAPEXE.SAR and SAPEXEDB.SAR). Alternatively, if you need it sooner, use the dw.sar hotfix and follow SAP Notes 2083594 and 19466. FAQ note 3793651 covers questions about this issue.
Context
This issue is one of three Message Server fixes in November. The others are Notes 3805570 (heap overflow over HTTP) and 3808552 (memory disclosure). All three are kernel fixes, so one kernel update covers them. However, SAP lists no workaround for any of them.
What to check
First, make sure that user networks cannot reach the external Message Server port, the entry point for the Message Server Memory Corruption. Second, check that ms/acl_info or ms/ACL_INFO restricts which hosts can register. Finally, separate the internal port (ms/server_port_0) as SAP’s Message Server hardening guidance recommends.
Why availability matters here
When the Message Server stops, logon balancing and enqueue communication break for the whole system. Therefore, the Message Server Memory Corruption is a full-system outage risk, not a single-process problem. Plan the kernel update accordingly, and keep the Message Server ports closed to everyone who does not need them.
Message Server Memory Corruption: advisory details
Component: BC-CST-MS
SAP priority: High
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 7
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: SAP Security Note 3789273 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
