CVE-2026-76968 Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
Authenticated low-privileged attackers can access administrative interfaces in SAP Web Dispatcher to obtain sensitive system state information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76968?
CVE-2026-76968 is a medium-severity vulnerability in SAP_SE SAP Web Dispatcher, Internet Communication Manager and SAP Content Server, published on 8 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed information could potentially be used to facilitate further attacks. This vulnerability has a high impact on the confidentiality of the application, with no impact on integrity or availability.
Weakness: CWE-497
Which versions are affected by CVE-2026-76968?
How do I fix CVE-2026-76968?
No fix has been published for CVE-2026-76968 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-76968 being exploited?
There is no known exploitation of CVE-2026-76968 in the wild and no public exploit code.
Sources
Also known as GHSA-w8rp-pp8p-wxh5.