CVE-2026-120008 Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service)
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-120008?
CVE-2026-120008 is a high-severity vulnerability in SAP_SE SAP NetWeaver (Internet Graphics Service), published on 10 Nov 2026.
Official description
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request to trigger an out-of-bounds memory write in a worker process. Successful exploitation could result in memory corruption or repeated termination of the affected process, resulting in a high impact on availability and a low impact on integrity with no impact on confidentiality.
Weakness: CWE-787
Which versions are affected by CVE-2026-120008?
How do I fix CVE-2026-120008?
No fix has been published for CVE-2026-120008 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-120008 being exploited?
There is no known exploitation of CVE-2026-120008 in the wild and no public exploit code.
Sources
Also known as GHSA-m4q3-78j7-767p.