What’s Vulnerable › Vulnerabilities

CVE-2026-76968: Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-08 · updated 2026-09-08
• Weakness: CWE-497

Description

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed information could potentially be used to facilitate further attacks. This vulnerability has a high impact on the confidentiality of the application, with no impact on integrity or availability.

Affected products

• SAP_SE SAP Web Dispatcher, Internet Communication Manager and SAP Content Server: KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, WEBDISP 7.22_EXT, 7.54 (+8)

References

• https://me.sap.com/notes/3750721
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-76968 or the next vulnerability affects your stack